Instruction: Please provide detailed information about CVE-2025-30796

CVE:CVE-2025-30796
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WP Extended The Ultimate WordPress Toolkit – WP Extended allows Reflected XSS. This issue affects The Ultimate WordPress Toolkit – WP Extended: from n/a through 3.0.14.
published:2025-04-01T06:15:51.397


Instruction: Please provide detailed information about CVE-2025-30797

CVE:CVE-2025-30797
Description:Missing Authorization vulnerability in bigdrop.gr Greek Multi Tool – Fix peralinks, accents, auto create menus and more allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Greek Multi Tool – Fix peralinks, accents, auto create menus and more: from n/a through 2.3.1.
published:2025-04-01T06:15:51.560


Instruction: Please provide detailed information about CVE-2025-30798

CVE:CVE-2025-30798
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in rickonline_nl Better WishList API allows Reflected XSS. This issue affects Better WishList API: from n/a through 1.1.4.
published:2025-04-01T06:15:51.727


Instruction: Please provide detailed information about CVE-2025-30802

CVE:CVE-2025-30802
Description:Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in WPBean Our Team Members. This issue affects Our Team Members: from n/a through 2.2.
published:2025-04-01T06:15:51.880


Instruction: Please provide detailed information about CVE-2025-30808

CVE:CVE-2025-30808
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in weblizar About Author allows Reflected XSS. This issue affects About Author: from n/a through 1.6.2.
published:2025-04-01T06:15:52.060


Instruction: Please provide detailed information about CVE-2025-30827

CVE:CVE-2025-30827
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Saleswonder Team Tobias WP2LEADS allows Reflected XSS. This issue affects WP2LEADS: from n/a through 3.4.5.
published:2025-04-01T06:15:52.220


Instruction: Please provide detailed information about CVE-2025-30834

CVE:CVE-2025-30834
Description:Path Traversal vulnerability in Bit Apps Bit Assist allows Path Traversal. This issue affects Bit Assist: from n/a through 1.5.4.
published:2025-04-01T06:15:52.383


Instruction: Please provide detailed information about CVE-2025-30837

CVE:CVE-2025-30837
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Cristiano Zanca WooCommerce Fattureincloud allows Reflected XSS. This issue affects WooCommerce Fattureincloud: from n/a through 2.6.7.
published:2025-04-01T06:15:52.563


Instruction: Please provide detailed information about CVE-2025-30840

CVE:CVE-2025-30840
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Michel - xiligroup dev xili-dictionary allows Reflected XSS. This issue affects xili-dictionary: from n/a through 2.12.5.
published:2025-04-01T06:15:52.733


Instruction: Please provide detailed information about CVE-2025-30848

CVE:CVE-2025-30848
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Bob Hostel allows Reflected XSS. This issue affects Hostel: from n/a through 1.1.5.
published:2025-04-01T06:15:52.907


Instruction: Please provide detailed information about CVE-2025-30849

CVE:CVE-2025-30849
Description:Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in g5theme Essential Real Estate allows PHP Local File Inclusion. This issue affects Essential Real Estate: from n/a through 5.2.0.
published:2025-04-01T06:15:53.063


Instruction: Please provide detailed information about CVE-2025-30869

CVE:CVE-2025-30869
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Parakoos Image Wall allows Reflected XSS. This issue affects Image Wall: from n/a through 3.0.
published:2025-04-01T06:15:53.233


Instruction: Please provide detailed information about CVE-2025-30870

CVE:CVE-2025-30870
Description:Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in WP Travel Engine WP Travel Engine allows PHP Local File Inclusion. This issue affects WP Travel Engine: from n/a through 6.3.5.
published:2025-04-01T06:15:53.407


Instruction: Please provide detailed information about CVE-2025-30876

CVE:CVE-2025-30876
Description:Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Ads by WPQuads Ads by WPQuads allows SQL Injection. This issue affects Ads by WPQuads: from n/a through 2.0.87.1.
published:2025-04-01T06:15:53.570


Instruction: Please provide detailed information about CVE-2025-30878

CVE:CVE-2025-30878
Description:Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in JoomSky JS Help Desk allows Path Traversal. This issue affects JS Help Desk: from n/a through 2.9.2.
published:2025-04-01T06:15:53.727


Instruction: Please provide detailed information about CVE-2025-30880

CVE:CVE-2025-30880
Description:Missing Authorization vulnerability in JoomSky JS Help Desk allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects JS Help Desk: from n/a through 2.9.2.
published:2025-04-01T06:15:53.900


Instruction: Please provide detailed information about CVE-2025-30882

CVE:CVE-2025-30882
Description:Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in JoomSky JS Help Desk allows Path Traversal. This issue affects JS Help Desk: from n/a through 2.9.1.
published:2025-04-01T06:15:54.070


Instruction: Please provide detailed information about CVE-2025-30886

CVE:CVE-2025-30886
Description:Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in JoomSky JS Help Desk allows SQL Injection. This issue affects JS Help Desk: from n/a through 2.9.2.
published:2025-04-01T06:15:54.230


Instruction: Please provide detailed information about CVE-2025-30901

CVE:CVE-2025-30901
Description:Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in JoomSky JS Help Desk allows PHP Local File Inclusion. This issue affects JS Help Desk: from n/a through 2.9.2.
published:2025-04-01T06:15:54.400


Instruction: Please provide detailed information about CVE-2025-30902

CVE:CVE-2025-30902
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ATL Software SRL AEC Kiosque allows Reflected XSS. This issue affects AEC Kiosque: from n/a through 1.9.3.
published:2025-04-01T06:15:54.550


Instruction: Please provide detailed information about CVE-2025-30910

CVE:CVE-2025-30910
Description:Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in CreativeMindsSolutions CM Download Manager allows Path Traversal. This issue affects CM Download Manager: from n/a through 2.9.6.
published:2025-04-01T06:15:54.707


Instruction: Please provide detailed information about CVE-2025-30911

CVE:CVE-2025-30911
Description:Improper Control of Generation of Code ('Code Injection') vulnerability in Rometheme RomethemeKit For Elementor allows Command Injection. This issue affects RomethemeKit For Elementor: from n/a through 1.5.4.
published:2025-04-01T06:15:54.877


Instruction: Please provide detailed information about CVE-2025-30917

CVE:CVE-2025-30917
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WP Wham SKU Generator for WooCommerce allows Reflected XSS. This issue affects SKU Generator for WooCommerce: from n/a through 1.6.2.
published:2025-04-01T06:15:55.047


Instruction: Please provide detailed information about CVE-2025-30924

CVE:CVE-2025-30924
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in primersoftware Primer MyData for Woocommerce allows Reflected XSS. This issue affects Primer MyData for Woocommerce: from n/a through n/a.
published:2025-04-01T06:15:55.210


Instruction: Please provide detailed information about CVE-2025-30926

CVE:CVE-2025-30926
Description:Missing Authorization vulnerability in KingAddons.com King Addons for Elementor. This issue affects King Addons for Elementor: from n/a through 24.12.58.
published:2025-04-01T06:15:55.367


Instruction: Please provide detailed information about CVE-2025-30971

CVE:CVE-2025-30971
Description:Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Xavi Ivars XV Random Quotes allows SQL Injection. This issue affects XV Random Quotes: from n/a through 1.40.
published:2025-04-01T06:15:55.543


Instruction: Please provide detailed information about CVE-2025-31001

CVE:CVE-2025-31001
Description:Debug Messages Revealing Unnecessary Information vulnerability in TLA Media GTM Kit allows Retrieve Embedded Sensitive Data. This issue affects GTM Kit: from n/a through 2.3.1.
published:2025-04-01T06:15:55.710


Instruction: Please provide detailed information about CVE-2025-31024

CVE:CVE-2025-31024
Description:Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in randyjensen RJ Quickcharts allows SQL Injection. This issue affects RJ Quickcharts: from n/a through 0.6.1.
published:2025-04-01T06:15:55.900


Instruction: Please provide detailed information about CVE-2025-31074

CVE:CVE-2025-31074
Description:Deserialization of Untrusted Data vulnerability in MDJM MDJM Event Management allows Object Injection. This issue affects MDJM Event Management: from n/a through 1.7.5.2.
published:2025-04-01T06:15:56.077


Instruction: Please provide detailed information about CVE-2025-31084

CVE:CVE-2025-31084
Description:Deserialization of Untrusted Data vulnerability in sunshinephotocart Sunshine Photo Cart allows Object Injection. This issue affects Sunshine Photo Cart: from n/a through 3.4.10.
published:2025-04-01T06:15:56.233


Instruction: Please provide detailed information about CVE-2025-31087

CVE:CVE-2025-31087
Description:Deserialization of Untrusted Data vulnerability in silverplugins217 Multiple Shipping And Billing Address For Woocommerce allows Object Injection. This issue affects Multiple Shipping And Billing Address For Woocommerce: from n/a through 1.5.
published:2025-04-01T06:15:56.390


Instruction: Please provide detailed information about CVE-2025-31095

CVE:CVE-2025-31095
Description:Authentication Bypass Using an Alternate Path or Channel vulnerability in ho3einie Material Dashboard allows Authentication Bypass. This issue affects Material Dashboard: from n/a through 1.4.5.
published:2025-04-01T06:15:56.570


Instruction: Please provide detailed information about CVE-2025-31409

CVE:CVE-2025-31409
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in NotFound Bridge Core allows Stored XSS. This issue affects Bridge Core: from n/a through n/a.
published:2025-04-01T06:15:56.730


Instruction: Please provide detailed information about CVE-2025-31415

CVE:CVE-2025-31415
Description:Missing Authorization vulnerability in YayCommerce YayExtra allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects YayExtra: from n/a through 1.5.2.
published:2025-04-01T06:15:56.923


Instruction: Please provide detailed information about CVE-2025-1267

CVE:CVE-2025-1267
Description:The Groundhogg plugin for Wordpress is vulnerable to Stored Cross-Site Scripting via the ‘label' parameter in versions up to, and including, 3.7.4.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Administrator-level access, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.
published:2025-04-01T07:15:38.697


Instruction: Please provide detailed information about CVE-2025-1512

CVE:CVE-2025-1512
Description:The PowerPack Elementor Addons (Free Widgets, Extensions and Templates) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Custom Cursor Extension in all versions up to, and including, 2.9.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
published:2025-04-01T07:15:38.870


Instruction: Please provide detailed information about CVE-2025-27427

CVE:CVE-2025-27427
Description:A vulnerability exists in Apache ActiveMQ Artemis whereby a user with the createDurableQueue or createNonDurableQueue permission on an address can augment the routing-type supported by that address even if said user doesn't have the createAddress permission for that particular address. When combined with the send permission and automatic queue creation a user could successfully send a message with a routing-type not supported by the address when that message should actually be rejected on the basis that the user doesn't have permission to change the routing-type of the address.  This issue affects Apache ActiveMQ Artemis from 2.0.0 through 2.39.0.  Users are recommended to upgrade to version 2.40.0 which fixes the issue.
published:2025-04-01T08:15:13.860


Instruction: Please provide detailed information about CVE-2025-29868

CVE:CVE-2025-29868
Description:Private Data Structure Returned From A Public Method vulnerability in Apache Answer.  This issue affects Apache Answer: through 1.4.2.  If a user uses an externally referenced image, when a user accesses this image, the provider of the image may obtain private information about the ip address of that accessing user. Users are recommended to upgrade to version 1.4.5, which fixes the issue. In the new version, administrators can set whether external content can be displayed.
published:2025-04-01T08:15:14.990


Instruction: Please provide detailed information about CVE-2025-2891

CVE:CVE-2025-2891
Description:The Real Estate 7 WordPress theme for WordPress is vulnerable to arbitrary file uploads due to missing file type validation via the 'template-submit-listing.php' file in all versions up to, and including, 3.5.4. This makes it possible for authenticated attackers, with Seller-level access and above, to upload arbitrary files on the affected site's server which may make remote code execution possible if front-end listing submission has been enabled.
published:2025-04-01T08:15:15.120


Instruction: Please provide detailed information about CVE-2025-30065

CVE:CVE-2025-30065
Description:Schema parsing in the parquet-avro module of Apache Parquet 1.15.0 and previous versions allows bad actors to execute arbitrary code   Users are recommended to upgrade to version 1.15.1, which fixes the issue.
published:2025-04-01T08:15:15.283


Instruction: Please provide detailed information about CVE-2025-27130

CVE:CVE-2025-27130
Description:Welcart e-Commerce 2.11.6 and earlier versions contains an untrusted data deserialization vulnerability. If this vulnerability is exploited, arbitrary code may be executed by a remote unauthenticated attacker who can access websites created using the product.
published:2025-04-01T09:15:15.657


Instruction: Please provide detailed information about CVE-2025-3082

CVE:CVE-2025-3082
Description:A user authorized to access a view may be able to alter the intended collation, allowing them to access to a different or unintended view of underlying data. This issue affects MongoDB Server v5.0 version prior to 5.0.31, MongoDB Server v6.0 version prior to 6.0.20, MongoDB Server v7.0 version prior to 7.0.14 and MongoDB Server v7.3 versions prior to 7.3.4.
published:2025-04-01T11:15:39.517


Instruction: Please provide detailed information about CVE-2025-2237

CVE:CVE-2025-2237
Description:The WP RealEstate plugin for WordPress, used by the Homeo theme, is vulnerable to authentication bypass in all versions up to, and including, 1.6.26. This is due to insufficient role restrictions in the 'process_register' function. This makes it possible for unauthenticated attackers to register an account with the Administrator role.
published:2025-04-01T12:15:15.420


Instruction: Please provide detailed information about CVE-2025-2906

CVE:CVE-2025-2906
Description:The Contempo Real Estate Core plugin for WordPress is vulnerable to Stored Cross-Site Scripting via shortcodes in versions up to, and including, 3.6.3 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
published:2025-04-01T12:15:15.580


Instruction: Please provide detailed information about CVE-2025-30177

CVE:CVE-2025-30177
Description:Bypass/Injection vulnerability in Apache Camel in Camel-Undertow component under particular conditions.  This issue affects Apache Camel: from 4.10.0 before 4.10.3, from 4.8.0 before 4.8.6.  Users are recommended to upgrade to version 4.10.3 for 4.10.x LTS and 4.8.6 for 4.8.x LTS.  Camel undertow component is vulnerable to Camel message header injection, in particular the custom header filter strategy used by the component only filter the "out" direction, while it doesn't filter the "in" direction.   This allows an attacker to include Camel specific headers that for some Camel components can alter the behaviour such as the camel-bean component, or the camel-exec component.
published:2025-04-01T12:15:15.747


Instruction: Please provide detailed information about CVE-2025-3083

CVE:CVE-2025-3083
Description:Specifically crafted MongoDB wire protocol messages can cause mongos to crash during command validation. This can occur without using an authenticated connection. This issue affects MongoDB v5.0 versions prior to 5.0.31,  MongoDB v6.0 versions prior to 6.0.20 and MongoDB v7.0 versions prior to 7.0.16
published:2025-04-01T12:15:15.883


Instruction: Please provide detailed information about CVE-2025-3084

CVE:CVE-2025-3084
Description:When run on commands with certain arguments set, explain may fail to validate these arguments before using them. This can lead to crashes in router servers. This affects MongoDB Server v5.0 prior to 5.0.31, MongoDB Server v6.0 prior to 6.0.20, MongoDB Server v7.0 prior to 7.0.16 and MongoDB Server v8.0 prior to 8.0.4
published:2025-04-01T12:15:16.037


Instruction: Please provide detailed information about CVE-2025-3085

CVE:CVE-2025-3085
Description:A MongoDB server under specific conditions running on Linux with TLS and CRL revocation status checking enabled, fails to check the revocation status of the intermediate certificates in the peer's certificate chain. In cases of MONGODB-X509, which is not enabled by default, this may lead to improper authentication. This issue may also affect intra-cluster authentication. This issue affects MongoDB Server v5.0 versions prior to 5.0.31, MongoDB Server v6.0 versions prior to 6.0.20, MongoDB Server v7.0 versions prior to 7.0.16 and MongoDB Server v8.0 versions prior to 8.0.4. Required Configuration : MongoDB Server must be running on Linux Operating Systems and CRL revocation status checking must be enabled
published:2025-04-01T12:15:16.187


Instruction: Please provide detailed information about CVE-2025-1658

CVE:CVE-2025-1658
Description:A maliciously crafted DWFX file, when parsed through Autodesk Navisworks, can force an Out-of-Bounds Read vulnerability. A malicious actor can leverage this vulnerability to cause a crash, read sensitive data, or execute arbitrary code in the context of the current process.
published:2025-04-01T13:15:39.753


Instruction: Please provide detailed information about CVE-2025-1659

CVE:CVE-2025-1659
Description:A maliciously crafted DWFX file, when parsed through Autodesk Navisworks, can force an Out-of-Bounds Read vulnerability. A malicious actor can leverage this vulnerability to cause a crash, read sensitive data, or execute arbitrary code in the context of the current process.
published:2025-04-01T13:15:39.913


Instruction: Please provide detailed information about CVE-2025-1660

CVE:CVE-2025-1660
Description:A maliciously crafted DWFX file, when parsed through Autodesk Navisworks, can force a Memory Corruption vulnerability. A malicious actor can leverage this vulnerability to execute arbitrary code in the context of the current process.
published:2025-04-01T13:15:40.053


Instruction: Please provide detailed information about CVE-2025-22231

CVE:CVE-2025-22231
Description:VMware Aria Operations contains a local privilege escalation vulnerability. A malicious actor with local administrative privileges can escalate their privileges to root on the appliance running VMware Aria Operations.
published:2025-04-01T13:15:40.197


Instruction: Please provide detailed information about CVE-2025-31408

CVE:CVE-2025-31408
Description:Missing Authorization vulnerability in Zoho Flow allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Zoho Flow: from n/a through 2.13.3.
published:2025-04-01T13:15:41.037


Instruction: Please provide detailed information about CVE-2025-3028

CVE:CVE-2025-3028
Description:JavaScript code running while transforming a document with the XSLTProcessor could lead to a use-after-free. This vulnerability affects Firefox < 137, Firefox ESR < 115.22, Firefox ESR < 128.9, Thunderbird < 137, and Thunderbird < 128.9.
published:2025-04-01T13:15:41.190


Instruction: Please provide detailed information about CVE-2025-3029

CVE:CVE-2025-3029
Description:A crafted URL containing specific Unicode characters could have hidden the true origin of the page, resulting in a potential spoofing attack. This vulnerability affects Firefox < 137, Firefox ESR < 128.9, Thunderbird < 137, and Thunderbird < 128.9.
published:2025-04-01T13:15:41.290


Instruction: Please provide detailed information about CVE-2025-3030

CVE:CVE-2025-3030
Description:Memory safety bugs present in Firefox 136, Thunderbird 136, Firefox ESR 128.8, and Thunderbird 128.8. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox < 137, Firefox ESR < 128.9, Thunderbird < 137, and Thunderbird < 128.9.
published:2025-04-01T13:15:41.390


Instruction: Please provide detailed information about CVE-2025-3031

CVE:CVE-2025-3031
Description:An attacker could read 32 bits of values spilled onto the stack in a JIT compiled function. This vulnerability affects Firefox < 137 and Thunderbird < 137.
published:2025-04-01T13:15:41.493


Instruction: Please provide detailed information about CVE-2025-3032

CVE:CVE-2025-3032
Description:Leaking of file descriptors from the fork server to web content processes could allow for privilege escalation attacks. This vulnerability affects Firefox < 137 and Thunderbird < 137.
published:2025-04-01T13:15:41.587


Instruction: Please provide detailed information about CVE-2025-3033

CVE:CVE-2025-3033
Description:After selecting a malicious Windows `.url` shortcut from the local filesystem, an unexpected file could be uploaded.   *This bug only affects Firefox on Windows. Other operating systems are unaffected.* This vulnerability affects Firefox < 137 and Thunderbird < 137.
published:2025-04-01T13:15:41.697


Instruction: Please provide detailed information about CVE-2025-3034

CVE:CVE-2025-3034
Description:Memory safety bugs present in Firefox 136 and Thunderbird 136. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox < 137 and Thunderbird < 137.
published:2025-04-01T13:15:41.790


Instruction: Please provide detailed information about CVE-2025-3035

CVE:CVE-2025-3035
Description:By first using the AI chatbot in one tab and later activating it in another tab, the document title of the previous tab would leak into the chat prompt. This vulnerability affects Firefox < 137.
published:2025-04-01T13:15:41.893


Instruction: Please provide detailed information about CVE-2025-28395

CVE:CVE-2025-28395
Description:D-LINK DI-8100 16.07.26A1 is vulnerable to Buffer Overflow in the ipsec_road_asp function via the host_ip parameter.
published:2025-04-01T14:15:32.917


Instruction: Please provide detailed information about CVE-2025-28398

CVE:CVE-2025-28398
Description:D-LINK DI-8100 16.07.26A1 is vulnerable to Buffer Overflow in the ipsec_net_asp function via the remot_ip parameter.
published:2025-04-01T14:15:33.047


Instruction: Please provide detailed information about CVE-2025-30210

CVE:CVE-2025-30210
Description:Bruno is an open source IDE for exploring and testing APIs. Prior to 1.39.1, the custom tool-tip components which internally use react-tooltip were setting the content (in this case the Environment name) as raw HTML which then gets injected into DOM on hover. This, combined with loose Content Security Policy restrictions, allowed any valid HTML text containing inline script to get executed on hovering over the respective Environment's name. This vulnerability's attack surface is limited strictly to scenarios where users import collections from untrusted or malicious sources. The exploit requires deliberate action from the user—specifically, downloading and opening an externally provided malicious Bruno or Postman collection export and the user hovers on the environment name. This vulnerability is fixed in 1.39.1.
published:2025-04-01T15:16:05.647


Instruction: Please provide detailed information about CVE-2025-30224

CVE:CVE-2025-30224
Description:MyDumper is a MySQL Logical Backup Tool. The MySQL C client library (libmysqlclient) allows authenticated remote actors to read arbitrary files from client systems via a crafted server response to LOAD LOCAL INFILE query, leading to sensitive information disclosure when clients connect to untrusted MySQL servers without explicitly disabling the local infile capability. Mydumper has the local infile option enabled by default and does not have an option to disable it. This can lead to an unexpected arbitrary file read if the Mydumper tool connects to an untrusted server. This vulnerability is fixed in 0.18.2-8.
published:2025-04-01T15:16:05.837


Instruction: Please provide detailed information about CVE-2025-30354

CVE:CVE-2025-30354
Description:Bruno is an open source IDE for exploring and testing APIs. A bug in the assertion runtime caused assert expressions to run in Developer Mode, even if Safe Mode was selected. The bug resulted in the sandbox settings to be ignored for the particular case where a single request is run/sent. This vulnerability's attack surface is limited strictly to scenarios where users import collections from untrusted or malicious sources. The exploit requires deliberate action from the user—specifically, downloading and opening an externally provided malicious Bruno collection. The vulnerability is fixed in 1.39.1.
published:2025-04-01T15:16:05.983


Instruction: Please provide detailed information about CVE-2025-30676

CVE:CVE-2025-30676
Description:Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in Apache OFBiz.  This issue affects Apache OFBiz: before 18.12.19.  Users are recommended to upgrade to version 18.12.19, which fixes the issue.
published:2025-04-01T15:16:07.310


Instruction: Please provide detailed information about CVE-2025-31121

CVE:CVE-2025-31121
Description:OpenEMR is a free and open source electronic health records and medical practice management application. Prior to 7.0.3.1, the Patient Image feature in OpenEMR is vulnerable to cross-site scripting attacks via the EXIF title in an image. This vulnerability is fixed in 7.0.3.1.
published:2025-04-01T15:16:07.613


Instruction: Please provide detailed information about CVE-2025-31131

CVE:CVE-2025-31131
Description:YesWiki is a wiki system written in PHP. The squelette parameter is vulnerable to path traversal attacks, enabling read access to arbitrary files on the server. This vulnerability is fixed in 4.5.2.
published:2025-04-01T15:16:07.790


Instruction: Please provide detailed information about CVE-2025-31132

CVE:CVE-2025-31132
Description:Raven is an open-source messaging platform. A vulnerability allowed any logged in user to execute code via an API endpoint. This vulnerability is fixed in 2.1.10.
published:2025-04-01T15:16:07.987


Instruction: Please provide detailed information about CVE-2025-31730

CVE:CVE-2025-31730
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in DigitalCourt Marketer Addons allows Stored XSS. This issue affects Marketer Addons: from n/a through 1.0.1.
published:2025-04-01T15:16:08.867


Instruction: Please provide detailed information about CVE-2025-31731

CVE:CVE-2025-31731
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Philip John Author Bio Shortcode allows Stored XSS. This issue affects Author Bio Shortcode: from n/a through 2.5.3.
published:2025-04-01T15:16:09.010


Instruction: Please provide detailed information about CVE-2025-31732

CVE:CVE-2025-31732
Description:Missing Authorization vulnerability in gb-plugins GB Gallery Slideshow allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects GB Gallery Slideshow: from n/a through 1.3.
published:2025-04-01T15:16:09.163


Instruction: Please provide detailed information about CVE-2025-31733

CVE:CVE-2025-31733
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Boot Div WP Sitemap allows Stored XSS. This issue affects WP Sitemap: from n/a through 1.0.0.
published:2025-04-01T15:16:09.320


Instruction: Please provide detailed information about CVE-2025-31734

CVE:CVE-2025-31734
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Syed Balkhi Simple Post Expiration allows DOM-Based XSS. This issue affects Simple Post Expiration: from n/a through 1.0.1.
published:2025-04-01T15:16:09.470


Instruction: Please provide detailed information about CVE-2025-31735

CVE:CVE-2025-31735
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in C. Johnson Footnotes for WordPress allows Stored XSS. This issue affects Footnotes for WordPress: from n/a through 2016.1230.
published:2025-04-01T15:16:09.620


Instruction: Please provide detailed information about CVE-2025-31737

CVE:CVE-2025-31737
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in dxladner Client Showcase allows Stored XSS. This issue affects Client Showcase: from n/a through 1.2.0.
published:2025-04-01T15:16:09.770


Instruction: Please provide detailed information about CVE-2025-31738

CVE:CVE-2025-31738
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in yazamodeveloper LeadQuizzes allows Stored XSS. This issue affects LeadQuizzes: from n/a through 1.1.0.
published:2025-04-01T15:16:09.923


Instruction: Please provide detailed information about CVE-2025-31740

CVE:CVE-2025-31740
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in aThemeArt News, Magazine and Blog Elements allows Stored XSS. This issue affects News, Magazine and Blog Elements: from n/a through 1.3.
published:2025-04-01T15:16:10.080


Instruction: Please provide detailed information about CVE-2025-31741

CVE:CVE-2025-31741
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Filtr8 Easy Magazine allows DOM-Based XSS. This issue affects Easy Magazine: from n/a through 2.1.13.
published:2025-04-01T15:16:10.227


Instruction: Please provide detailed information about CVE-2025-31742

CVE:CVE-2025-31742
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in PixelDima Dima Take Action allows Stored XSS. This issue affects Dima Take Action: from n/a through 1.0.5.
published:2025-04-01T15:16:10.367


Instruction: Please provide detailed information about CVE-2025-31743

CVE:CVE-2025-31743
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in wpszaki Lightweight and Responsive Youtube Embed allows Stored XSS. This issue affects Lightweight and Responsive Youtube Embed: from n/a through 1.0.0.
published:2025-04-01T15:16:10.513


Instruction: Please provide detailed information about CVE-2025-31744

CVE:CVE-2025-31744
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in wpszaki Lightweight and Responsive Youtube Embed allows Stored XSS. This issue affects Lightweight and Responsive Youtube Embed: from n/a through 1.0.0.
published:2025-04-01T15:16:10.663


Instruction: Please provide detailed information about CVE-2025-31745

CVE:CVE-2025-31745
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Arni Cinco Subscription Form for Feedblitz allows Stored XSS. This issue affects Subscription Form for Feedblitz: from n/a through 1.0.9.
published:2025-04-01T15:16:10.807


Instruction: Please provide detailed information about CVE-2025-31747

CVE:CVE-2025-31747
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in milan.latinovic WP Chrono allows DOM-Based XSS. This issue affects WP Chrono: from n/a through 1.5.4.
published:2025-04-01T15:16:10.950


Instruction: Please provide detailed information about CVE-2025-31748

CVE:CVE-2025-31748
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in wpopal Opal Portfolio allows Stored XSS. This issue affects Opal Portfolio: from n/a through 1.0.4.
published:2025-04-01T15:16:11.100


Instruction: Please provide detailed information about CVE-2025-31749

CVE:CVE-2025-31749
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPelite HMH Footer Builder For Elementor allows Stored XSS. This issue affects HMH Footer Builder For Elementor: from n/a through 1.0.
published:2025-04-01T15:16:11.237


Instruction: Please provide detailed information about CVE-2025-31750

CVE:CVE-2025-31750
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in doit Breaking News WP allows Stored XSS. This issue affects Breaking News WP: from n/a through 1.3.
published:2025-04-01T15:16:11.390


Instruction: Please provide detailed information about CVE-2025-31751

CVE:CVE-2025-31751
Description:Cross-Site Request Forgery (CSRF) vulnerability in doit Breaking News WP allows Cross Site Request Forgery. This issue affects Breaking News WP: from n/a through 1.3.
published:2025-04-01T15:16:11.533


Instruction: Please provide detailed information about CVE-2025-31752

CVE:CVE-2025-31752
Description:Missing Authorization vulnerability in termel Bulk Fields Editor allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Bulk Fields Editor: from n/a through 1.8.0.
published:2025-04-01T15:16:11.690


Instruction: Please provide detailed information about CVE-2025-31754

CVE:CVE-2025-31754
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in DobsonDev DobsonDev Shortcodes allows Stored XSS. This issue affects DobsonDev Shortcodes: from n/a through 2.1.12.
published:2025-04-01T15:16:11.850


Instruction: Please provide detailed information about CVE-2025-31755

CVE:CVE-2025-31755
Description:Missing Authorization vulnerability in josselynj pCloud Backup allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects pCloud Backup: from n/a through 1.0.1.
published:2025-04-01T15:16:12.020


Instruction: Please provide detailed information about CVE-2025-31756

CVE:CVE-2025-31756
Description:Cross-Site Request Forgery (CSRF) vulnerability in tuyennv TZ PlusGallery allows Cross Site Request Forgery. This issue affects TZ PlusGallery: from n/a through 1.5.5.
published:2025-04-01T15:16:12.187


Instruction: Please provide detailed information about CVE-2025-31757

CVE:CVE-2025-31757
Description:Missing Authorization vulnerability in BinaryCarpenter Free Woocommerce Product Table View allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Free Woocommerce Product Table View: from n/a through 1.78.
published:2025-04-01T15:16:12.373


Instruction: Please provide detailed information about CVE-2025-31759

CVE:CVE-2025-31759
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in BooSpot Boo Recipes allows Stored XSS. This issue affects Boo Recipes: from n/a through 2.4.1.
published:2025-04-01T15:16:12.517


Instruction: Please provide detailed information about CVE-2025-31760

CVE:CVE-2025-31760
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in snapwidget SnapWidget Social Photo Feed Widget allows DOM-Based XSS. This issue affects SnapWidget Social Photo Feed Widget: from n/a through 1.1.0.
published:2025-04-01T15:16:12.670


Instruction: Please provide detailed information about CVE-2025-31761

CVE:CVE-2025-31761
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in DEJAN Hypotext allows Stored XSS. This issue affects Hypotext: from n/a through 1.0.1.
published:2025-04-01T15:16:12.823


Instruction: Please provide detailed information about CVE-2025-31762

CVE:CVE-2025-31762
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in andreyazimov Sheet2Site allows Stored XSS. This issue affects Sheet2Site: from n/a through 1.0.18.
published:2025-04-01T15:16:12.967


Instruction: Please provide detailed information about CVE-2025-31763

CVE:CVE-2025-31763
Description:Cross-Site Request Forgery (CSRF) vulnerability in Preliot Cache control by Cacholong allows Cross Site Request Forgery. This issue affects Cache control by Cacholong: from n/a through 5.4.1.
published:2025-04-01T15:16:13.120


Instruction: Please provide detailed information about CVE-2025-31764

CVE:CVE-2025-31764
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Preliot Cache control by Cacholong allows Stored XSS. This issue affects Cache control by Cacholong: from n/a through 5.4.1.
published:2025-04-01T15:16:13.267


Instruction: Please provide detailed information about CVE-2025-31765

CVE:CVE-2025-31765
Description:Missing Authorization vulnerability in themeqx GDPR Cookie Notice allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects GDPR Cookie Notice: from n/a through 1.2.0.
published:2025-04-01T15:16:13.410


Instruction: Please provide detailed information about CVE-2025-31766

CVE:CVE-2025-31766
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in PhotoShelter PhotoShelter for Photographers Blog Feed Plugin allows Stored XSS. This issue affects PhotoShelter for Photographers Blog Feed Plugin: from n/a through 1.5.7.
published:2025-04-01T15:16:13.560


Instruction: Please provide detailed information about CVE-2025-31767

CVE:CVE-2025-31767
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in OTWthemes  Post Custom Templates Lite allows Stored XSS. This issue affects  Post Custom Templates Lite: from n/a through 1.14.
published:2025-04-01T15:16:13.717


Instruction: Please provide detailed information about CVE-2025-31769

CVE:CVE-2025-31769
Description:Cross-Site Request Forgery (CSRF) vulnerability in NiteoThemes CLP – Custom Login Page by NiteoThemes allows Cross Site Request Forgery. This issue affects CLP – Custom Login Page by NiteoThemes: from n/a through 1.5.5.
published:2025-04-01T15:16:13.880


Instruction: Please provide detailed information about CVE-2025-31770

CVE:CVE-2025-31770
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in OTWthemes Content Manager Light allows Stored XSS. This issue affects Content Manager Light: from n/a through 3.2.
published:2025-04-01T15:16:14.127


Instruction: Please provide detailed information about CVE-2025-31771

CVE:CVE-2025-31771
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Sultan Nasir Uddin Team Members for Elementor Page Builder allows Stored XSS. This issue affects Team Members for Elementor Page Builder: from n/a through 1.0.4.
published:2025-04-01T15:16:14.280


Instruction: Please provide detailed information about CVE-2025-31772

CVE:CVE-2025-31772
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Astoundify WP Modal Popup with Cookie Integration allows Stored XSS. This issue affects WP Modal Popup with Cookie Integration: from n/a through 2.4.
published:2025-04-01T15:16:14.437


Instruction: Please provide detailed information about CVE-2025-31773

CVE:CVE-2025-31773
Description:Missing Authorization vulnerability in cedcommerce Ship Per Product allows Accessing Functionality Not Properly Constrained by ACLs. This issue affects Ship Per Product: from n/a through 2.1.0.
published:2025-04-01T15:16:14.590


Instruction: Please provide detailed information about CVE-2025-31774

CVE:CVE-2025-31774
Description:Missing Authorization vulnerability in WebProtect.ai Astra Security Suite allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Astra Security Suite: from n/a through 0.2.
published:2025-04-01T15:16:14.733


Instruction: Please provide detailed information about CVE-2025-31775

CVE:CVE-2025-31775
Description:Cross-Site Request Forgery (CSRF) vulnerability in smackcoders Google SEO Pressor Snippet allows Cross Site Request Forgery. This issue affects Google SEO Pressor Snippet: from n/a through 2.0.
published:2025-04-01T15:16:14.897


Instruction: Please provide detailed information about CVE-2025-31776

CVE:CVE-2025-31776
Description:Cross-Site Request Forgery (CSRF) vulnerability in Aphotrax Uptime Robot Plugin for WordPress allows Cross Site Request Forgery. This issue affects Uptime Robot Plugin for WordPress: from n/a through 2.3.
published:2025-04-01T15:16:15.053


Instruction: Please provide detailed information about CVE-2025-31777

CVE:CVE-2025-31777
Description:Missing Authorization vulnerability in BeastThemes Clockinator Lite allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Clockinator Lite: from n/a through 1.0.7.
published:2025-04-01T15:16:15.207


Instruction: Please provide detailed information about CVE-2025-31778

CVE:CVE-2025-31778
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in raphaelheide Donate Me allows Reflected XSS. This issue affects Donate Me: from n/a through 1.2.5.
published:2025-04-01T15:16:15.360


Instruction: Please provide detailed information about CVE-2025-31779

CVE:CVE-2025-31779
Description:Cross-Site Request Forgery (CSRF) vulnerability in Jonathan Daggerhart Query Wrangler allows Cross Site Request Forgery. This issue affects Query Wrangler: from n/a through 1.5.53.
published:2025-04-01T15:16:15.517


Instruction: Please provide detailed information about CVE-2025-31780

CVE:CVE-2025-31780
Description:Missing Authorization vulnerability in Andy Stratton Append Content allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Append Content: from n/a through 2.1.1.
published:2025-04-01T15:16:15.663


Instruction: Please provide detailed information about CVE-2025-31781

CVE:CVE-2025-31781
Description:Missing Authorization vulnerability in ahmadshyk Gift Cards for WooCommerce allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Gift Cards for WooCommerce: from n/a through 1.5.8.
published:2025-04-01T15:16:15.810


Instruction: Please provide detailed information about CVE-2025-31782

CVE:CVE-2025-31782
Description:Missing Authorization vulnerability in pupunzi mb.YTPlayer allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects mb.YTPlayer: from n/a through 3.3.8.
published:2025-04-01T15:16:15.960


Instruction: Please provide detailed information about CVE-2025-31783

CVE:CVE-2025-31783
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Leartes.NET Leartes TRY Exchange Rates allows Stored XSS. This issue affects Leartes TRY Exchange Rates: from n/a through 2.1.
published:2025-04-01T15:16:16.113


Instruction: Please provide detailed information about CVE-2025-31784

CVE:CVE-2025-31784
Description:Cross-Site Request Forgery (CSRF) vulnerability in Rudy Susanto Embed Extended – Embed Maps, Videos, Websites, Source Codes, and more allows Cross Site Request Forgery. This issue affects Embed Extended – Embed Maps, Videos, Websites, Source Codes, and more: from n/a through 1.4.0.
published:2025-04-01T15:16:16.253


Instruction: Please provide detailed information about CVE-2025-31785

CVE:CVE-2025-31785
Description:Cross-Site Request Forgery (CSRF) vulnerability in Clearbit Clearbit Reveal allows Cross Site Request Forgery. This issue affects Clearbit Reveal: from n/a through 1.0.6.
published:2025-04-01T15:16:16.410


Instruction: Please provide detailed information about CVE-2025-31786

CVE:CVE-2025-31786
Description:Missing Authorization vulnerability in Travis Simple Icons allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Simple Icons: from n/a through 2.8.4.
published:2025-04-01T15:16:16.557


Instruction: Please provide detailed information about CVE-2025-31787

CVE:CVE-2025-31787
Description:Missing Authorization vulnerability in Brady Vercher Cue allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Cue: from n/a through 2.4.4.
published:2025-04-01T15:16:16.710


Instruction: Please provide detailed information about CVE-2025-31788

CVE:CVE-2025-31788
Description:Insertion of Sensitive Information into Log File vulnerability in smackcoders AIO Performance Profiler, Monitor, Optimize, Compress & Debug allows Retrieve Embedded Sensitive Data. This issue affects AIO Performance Profiler, Monitor, Optimize, Compress & Debug: from n/a through 1.2.
published:2025-04-01T15:16:16.847


Instruction: Please provide detailed information about CVE-2025-31790

CVE:CVE-2025-31790
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Binsaifullah Posten allows DOM-Based XSS. This issue affects Posten: from n/a through 0.0.1.
published:2025-04-01T15:16:17.000


Instruction: Please provide detailed information about CVE-2025-31791

CVE:CVE-2025-31791
Description:Missing Authorization vulnerability in Oliver Boyers Pin Generator allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Pin Generator: from n/a through 2.0.0.
published:2025-04-01T15:16:17.147


Instruction: Please provide detailed information about CVE-2025-31792

CVE:CVE-2025-31792
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in piotnetdotcom Piotnet Forms allows Stored XSS. This issue affects Piotnet Forms: from n/a through 1.0.30.
published:2025-04-01T15:16:17.290


Instruction: Please provide detailed information about CVE-2025-31793

CVE:CVE-2025-31793
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in piotnetdotcom Piotnet Forms allows Stored XSS. This issue affects Piotnet Forms: from n/a through 1.0.30.
published:2025-04-01T15:16:17.440


Instruction: Please provide detailed information about CVE-2025-31796

CVE:CVE-2025-31796
Description:Server-Side Request Forgery (SSRF) vulnerability in TheInnovs Team ElementsCSS Addons for Elementor allows Server Side Request Forgery. This issue affects ElementsCSS Addons for Elementor: from n/a through 1.0.8.7.
published:2025-04-01T15:16:17.733


Instruction: Please provide detailed information about CVE-2025-31797

CVE:CVE-2025-31797
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in BoldGrid Sprout Clients allows Stored XSS. This issue affects Sprout Clients: from n/a through 3.2.
published:2025-04-01T15:16:18.747


Instruction: Please provide detailed information about CVE-2025-31798

CVE:CVE-2025-31798
Description:Missing Authorization vulnerability in publitio Publitio allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Publitio: from n/a through 2.1.8.
published:2025-04-01T15:16:18.893


Instruction: Please provide detailed information about CVE-2025-31799

CVE:CVE-2025-31799
Description:Missing Authorization vulnerability in publitio Publitio allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Publitio: from n/a through 2.1.8.
published:2025-04-01T15:16:19.040


Instruction: Please provide detailed information about CVE-2025-31801

CVE:CVE-2025-31801
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Maksym Marko MX Time Zone Clocks allows Reflected XSS. This issue affects MX Time Zone Clocks: from n/a through 5.1.1.
published:2025-04-01T15:16:19.197


Instruction: Please provide detailed information about CVE-2025-31802

CVE:CVE-2025-31802
Description:Missing Authorization vulnerability in Shiptimize Shiptimize for WooCommerce allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Shiptimize for WooCommerce: from n/a through 3.1.86.
published:2025-04-01T15:16:19.343


Instruction: Please provide detailed information about CVE-2025-31803

CVE:CVE-2025-31803
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Neteuro Turisbook Booking System allows Stored XSS. This issue affects Turisbook Booking System: from n/a through 1.3.7.
published:2025-04-01T15:16:19.500


Instruction: Please provide detailed information about CVE-2025-31804

CVE:CVE-2025-31804
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in DraftPress Team Follow Us Badges allows Stored XSS. This issue affects Follow Us Badges: from n/a through 3.1.11.
published:2025-04-01T15:16:19.660


Instruction: Please provide detailed information about CVE-2025-31805

CVE:CVE-2025-31805
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ExpressTech Systems Gutena Kit – Gutenberg Blocks and Templates allows Stored XSS. This issue affects Gutena Kit – Gutenberg Blocks and Templates: from n/a through 2.0.7.
published:2025-04-01T15:16:19.807


Instruction: Please provide detailed information about CVE-2025-31806

CVE:CVE-2025-31806
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in uSystems Webling allows Stored XSS. This issue affects Webling: from n/a through 3.9.0.
published:2025-04-01T15:16:19.967


Instruction: Please provide detailed information about CVE-2025-31807

CVE:CVE-2025-31807
Description:Cross-Site Request Forgery (CSRF) vulnerability in CloudRedux Product Notices for WooCommerce allows Cross Site Request Forgery. This issue affects Product Notices for WooCommerce: from n/a through 1.3.3.
published:2025-04-01T15:16:20.123


Instruction: Please provide detailed information about CVE-2025-31808

CVE:CVE-2025-31808
Description:Cross-Site Request Forgery (CSRF) vulnerability in IT Path Solutions SCSS WP Editor allows Cross Site Request Forgery. This issue affects SCSS WP Editor: from n/a through 1.1.8.
published:2025-04-01T15:16:20.280


Instruction: Please provide detailed information about CVE-2025-31809

CVE:CVE-2025-31809
Description:Cross-Site Request Forgery (CSRF) vulnerability in Labinator Labinator Content Types Duplicator allows Cross Site Request Forgery. This issue affects Labinator Content Types Duplicator: from n/a through 1.1.3.
published:2025-04-01T15:16:20.437


Instruction: Please provide detailed information about CVE-2025-31810

CVE:CVE-2025-31810
Description:Missing Authorization vulnerability in PickPlugins Question Answer allows Accessing Functionality Not Properly Constrained by ACLs. This issue affects Question Answer: from n/a through 1.2.70.
published:2025-04-01T15:16:20.597


Instruction: Please provide detailed information about CVE-2025-31811

CVE:CVE-2025-31811
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in xtreeme Planyo online reservation system allows Stored XSS. This issue affects Planyo online reservation system: from n/a through 3.0.
published:2025-04-01T15:16:20.750


Instruction: Please provide detailed information about CVE-2025-31812

CVE:CVE-2025-31812
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Tomas BuddyPress Members Only allows Stored XSS. This issue affects BuddyPress Members Only: from n/a through 3.5.3.
published:2025-04-01T15:16:20.907


Instruction: Please provide detailed information about CVE-2025-31813

CVE:CVE-2025-31813
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Website366.com WPSHARE247 Elementor Addons allows Stored XSS. This issue affects WPSHARE247 Elementor Addons: from n/a through 2.1.
published:2025-04-01T15:16:21.047


Instruction: Please provide detailed information about CVE-2025-31814

CVE:CVE-2025-31814
Description:Cross-Site Request Forgery (CSRF) vulnerability in OwnerRez OwnerRez allows Cross Site Request Forgery. This issue affects OwnerRez: from n/a through 1.2.0.
published:2025-04-01T15:16:21.193


Instruction: Please provide detailed information about CVE-2025-31815

CVE:CVE-2025-31815
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in devscred Design Blocks allows Stored XSS. This issue affects Design Blocks: from n/a through 1.2.2.
published:2025-04-01T15:16:21.343


Instruction: Please provide detailed information about CVE-2025-31816

CVE:CVE-2025-31816
Description:Missing Authorization vulnerability in pietro Mobile App Canvas allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Mobile App Canvas: from n/a through 3.8.1.
published:2025-04-01T15:16:21.500


Instruction: Please provide detailed information about CVE-2025-31817

CVE:CVE-2025-31817
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPWheels BlockWheels allows DOM-Based XSS. This issue affects BlockWheels: from n/a through 1.0.1.
published:2025-04-01T15:16:21.660


Instruction: Please provide detailed information about CVE-2025-31818

CVE:CVE-2025-31818
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ContentBot.ai ContentBot AI Writer allows Stored XSS. This issue affects ContentBot AI Writer: from n/a through 1.2.4.
published:2025-04-01T15:16:21.803


Instruction: Please provide detailed information about CVE-2025-31820

CVE:CVE-2025-31820
Description:Missing Authorization vulnerability in webdevstudios Automatic Featured Images from Videos allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Automatic Featured Images from Videos: from n/a through 1.2.4.
published:2025-04-01T15:16:21.967


Instruction: Please provide detailed information about CVE-2025-31821

CVE:CVE-2025-31821
Description:URL Redirection to Untrusted Site ('Open Redirect') vulnerability in formsintegrations Integration of Zoho CRM and Contact Form 7 allows Phishing. This issue affects Integration of Zoho CRM and Contact Form 7: from n/a through 1.0.6.
published:2025-04-01T15:16:22.127


Instruction: Please provide detailed information about CVE-2025-31822

CVE:CVE-2025-31822
Description:Missing Authorization vulnerability in Ashish Ajani WP Simple HTML Sitemap allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects WP Simple HTML Sitemap: from n/a through 3.2.
published:2025-04-01T15:16:22.273


Instruction: Please provide detailed information about CVE-2025-31823

CVE:CVE-2025-31823
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in wpoperations WPoperation Elementor Addons allows Stored XSS. This issue affects WPoperation Elementor Addons: from n/a through 1.1.9.
published:2025-04-01T15:16:22.430


Instruction: Please provide detailed information about CVE-2025-31824

CVE:CVE-2025-31824
Description:Server-Side Request Forgery (SSRF) vulnerability in Wombat Plugins WP Optin Wheel allows Server Side Request Forgery. This issue affects WP Optin Wheel: from n/a through 1.4.7.
published:2025-04-01T15:16:22.580


Instruction: Please provide detailed information about CVE-2025-31826

CVE:CVE-2025-31826
Description:Missing Authorization vulnerability in Anzar Ahmed Ni WooCommerce Cost Of Goods allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Ni WooCommerce Cost Of Goods: from n/a through 3.2.8.
published:2025-04-01T15:16:22.727


Instruction: Please provide detailed information about CVE-2025-31828

CVE:CVE-2025-31828
Description:Cross-Site Request Forgery (CSRF) vulnerability in alextselegidis Easy!Appointments allows Cross Site Request Forgery. This issue affects Easy!Appointments: from n/a through 1.4.2.
published:2025-04-01T15:16:22.887


Instruction: Please provide detailed information about CVE-2025-31829

CVE:CVE-2025-31829
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in devscred ShopCred allows DOM-Based XSS. This issue affects ShopCred: from n/a through 1.2.8.
published:2025-04-01T15:16:23.040


Instruction: Please provide detailed information about CVE-2025-31830

CVE:CVE-2025-31830
Description:Missing Authorization vulnerability in Uriahs Victor Printus allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Printus: from n/a through 1.2.6.
published:2025-04-01T15:16:23.190


Instruction: Please provide detailed information about CVE-2025-31831

CVE:CVE-2025-31831
Description:Missing Authorization vulnerability in Team AtomChat AtomChat allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects AtomChat: from n/a through 1.1.6.
published:2025-04-01T15:16:23.340


Instruction: Please provide detailed information about CVE-2025-31832

CVE:CVE-2025-31832
Description:Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in Beee ACF City Selector allows Retrieve Embedded Sensitive Data. This issue affects ACF City Selector: from n/a through 1.16.0.
published:2025-04-01T15:16:23.493


Instruction: Please provide detailed information about CVE-2025-31833

CVE:CVE-2025-31833
Description:Authorization Bypass Through User-Controlled Key vulnerability in themeglow JobBoard Job listing allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects JobBoard Job listing: from n/a through 1.2.7.
published:2025-04-01T15:16:23.643


Instruction: Please provide detailed information about CVE-2025-31834

CVE:CVE-2025-31834
Description:Missing Authorization vulnerability in themeglow JobBoard Job listing allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects JobBoard Job listing: from n/a through 1.2.7.
published:2025-04-01T15:16:23.793


Instruction: Please provide detailed information about CVE-2025-31835

CVE:CVE-2025-31835
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Brice Capobianco WP Plugin Info Card allows DOM-Based XSS. This issue affects WP Plugin Info Card: from n/a through 5.2.5.
published:2025-04-01T15:16:23.953


Instruction: Please provide detailed information about CVE-2025-31836

CVE:CVE-2025-31836
Description:Missing Authorization vulnerability in matthewrubin Review Manager allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Review Manager: from n/a through 2.2.0.
published:2025-04-01T15:16:24.100


Instruction: Please provide detailed information about CVE-2025-31837

CVE:CVE-2025-31837
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WP Codeus WP Proposals allows Stored XSS. This issue affects WP Proposals: from n/a through 2.3.
published:2025-04-01T15:16:24.267


Instruction: Please provide detailed information about CVE-2025-31838

CVE:CVE-2025-31838
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in eventbee Eventbee RSVP Widget allows DOM-Based XSS. This issue affects Eventbee RSVP Widget: from n/a through 1.0.
published:2025-04-01T15:16:24.430


Instruction: Please provide detailed information about CVE-2025-31839

CVE:CVE-2025-31839
Description:Cross-Site Request Forgery (CSRF) vulnerability in digireturn DN Footer Contacts allows Cross Site Request Forgery. This issue affects DN Footer Contacts: from n/a through 1.8.
published:2025-04-01T15:16:24.583


Instruction: Please provide detailed information about CVE-2025-31840

CVE:CVE-2025-31840
Description:Cross-Site Request Forgery (CSRF) vulnerability in digireturn Simple Fixed Notice allows Cross Site Request Forgery. This issue affects Simple Fixed Notice: from n/a through 1.6.
published:2025-04-01T15:16:24.723


Instruction: Please provide detailed information about CVE-2025-31842

CVE:CVE-2025-31842
Description:Insertion of Sensitive Information Into Sent Data vulnerability in viralloops Viral Loops WP Integration allows Retrieve Embedded Sensitive Data. This issue affects Viral Loops WP Integration: from n/a through 3.4.0.
published:2025-04-01T15:16:24.887


Instruction: Please provide detailed information about CVE-2025-31843

CVE:CVE-2025-31843
Description:Missing Authorization vulnerability in Wilson OpenAI Tools for WordPress & WooCommerce allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects OpenAI Tools for WordPress & WooCommerce: from n/a through 2.1.5.
published:2025-04-01T15:16:25.033


Instruction: Please provide detailed information about CVE-2025-31844

CVE:CVE-2025-31844
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Noor Alam Magical Blocks allows Stored XSS. This issue affects Magical Blocks: from n/a through 1.0.10.
published:2025-04-01T15:16:25.183


Instruction: Please provide detailed information about CVE-2025-31845

CVE:CVE-2025-31845
Description:Cross-Site Request Forgery (CSRF) vulnerability in Rohit Choudhary Theme Duplicator allows Cross Site Request Forgery. This issue affects Theme Duplicator: from n/a through 1.1.
published:2025-04-01T15:16:25.337


Instruction: Please provide detailed information about CVE-2025-31846

CVE:CVE-2025-31846
Description:Missing Authorization vulnerability in Jeroen Schmit Theater for WordPress allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Theater for WordPress: from n/a through 0.18.7.
published:2025-04-01T15:16:25.470


Instruction: Please provide detailed information about CVE-2025-31847

CVE:CVE-2025-31847
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in themelooks mFolio Lite allows DOM-Based XSS. This issue affects mFolio Lite: from n/a through 1.2.2.
published:2025-04-01T15:16:25.633


Instruction: Please provide detailed information about CVE-2025-31848

CVE:CVE-2025-31848
Description:Missing Authorization vulnerability in WPFactory WordPress Adverts Plugin allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects WordPress Adverts Plugin: from n/a through 1.4.
published:2025-04-01T15:16:25.797


Instruction: Please provide detailed information about CVE-2025-31849

CVE:CVE-2025-31849
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in fbtemplates Nemesis All-in-One allows Stored XSS. This issue affects Nemesis All-in-One: from n/a through 1.1.0.
published:2025-04-01T15:16:25.980


Instruction: Please provide detailed information about CVE-2025-31850

CVE:CVE-2025-31850
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in RedefiningTheWeb PDF Generator Addon for Elementor Page Builder allows Stored XSS. This issue affects PDF Generator Addon for Elementor Page Builder: from n/a through 1.7.5.
published:2025-04-01T15:16:26.157


Instruction: Please provide detailed information about CVE-2025-31851

CVE:CVE-2025-31851
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in markkinchin Beds24 Online Booking allows Stored XSS. This issue affects Beds24 Online Booking: from n/a through 2.0.26.
published:2025-04-01T15:16:26.307


Instruction: Please provide detailed information about CVE-2025-31852

CVE:CVE-2025-31852
Description:Cross-Site Request Forgery (CSRF) vulnerability in N-Media Bulk Product Sync allows Cross Site Request Forgery. This issue affects Bulk Product Sync: from n/a through 8.6.
published:2025-04-01T15:16:26.467


Instruction: Please provide detailed information about CVE-2025-31853

CVE:CVE-2025-31853
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Erez Hadas-Sonnenschein Smartarget Popup allows Stored XSS. This issue affects Smartarget Popup: from n/a through 1.4.
published:2025-04-01T15:16:26.640


Instruction: Please provide detailed information about CVE-2025-31854

CVE:CVE-2025-31854
Description:Missing Authorization vulnerability in Sharaz Shahid Simple Sticky Add To Cart For WooCommerce allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Simple Sticky Add To Cart For WooCommerce: from n/a through 1.4.5.
published:2025-04-01T15:16:26.820


Instruction: Please provide detailed information about CVE-2025-31855

CVE:CVE-2025-31855
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in softnwords SMM API allows Stored XSS. This issue affects SMM API: from n/a through 6.0.27.
published:2025-04-01T15:16:26.993


Instruction: Please provide detailed information about CVE-2025-31856

CVE:CVE-2025-31856
Description:Missing Authorization vulnerability in brainvireinfo Export All Post Meta allows Accessing Functionality Not Properly Constrained by ACLs. This issue affects Export All Post Meta: from n/a through 1.2.1.
published:2025-04-01T15:16:27.133


Instruction: Please provide detailed information about CVE-2025-31857

CVE:CVE-2025-31857
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in wpWax Directorist AddonsKit for Elementor allows Stored XSS. This issue affects Directorist AddonsKit for Elementor: from n/a through 1.1.6.
published:2025-04-01T15:16:27.293


Instruction: Please provide detailed information about CVE-2025-31859

CVE:CVE-2025-31859
Description:Cross-Site Request Forgery (CSRF) vulnerability in Feedbucket Feedbucket – Website Feedback Tool allows Cross Site Request Forgery. This issue affects Feedbucket – Website Feedback Tool: from n/a through 1.0.6.
published:2025-04-01T15:16:27.440


Instruction: Please provide detailed information about CVE-2025-31860

CVE:CVE-2025-31860
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPeka WP AdCenter allows Stored XSS. This issue affects WP AdCenter: from n/a through 2.5.9.
published:2025-04-01T15:16:27.583


Instruction: Please provide detailed information about CVE-2025-31861

CVE:CVE-2025-31861
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPOrbit Support Perfect Font Awesome Integration allows Stored XSS. This issue affects Perfect Font Awesome Integration: from n/a through 2.2.
published:2025-04-01T15:16:27.947


Instruction: Please provide detailed information about CVE-2025-31862

CVE:CVE-2025-31862
Description:Missing Authorization vulnerability in PickPlugins Job Board Manager allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Job Board Manager: from n/a through 2.1.60.
published:2025-04-01T15:16:28.113


Instruction: Please provide detailed information about CVE-2025-31863

CVE:CVE-2025-31863
Description:Missing Authorization vulnerability in inspry Agency Toolkit allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Agency Toolkit: from n/a through 1.0.23.
published:2025-04-01T15:16:28.257


Instruction: Please provide detailed information about CVE-2025-31864

CVE:CVE-2025-31864
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Out the Box Beam me up Scotty – Back to Top Button allows Stored XSS. This issue affects Beam me up Scotty – Back to Top Button: from n/a through 1.0.23.
published:2025-04-01T15:16:28.397


Instruction: Please provide detailed information about CVE-2025-31865

CVE:CVE-2025-31865
Description:Missing Authorization vulnerability in CartBoss SMS Abandoned Cart Recovery ✦ CartBoss allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects SMS Abandoned Cart Recovery ✦ CartBoss: from n/a through 4.1.2.
published:2025-04-01T15:16:28.540


Instruction: Please provide detailed information about CVE-2025-31866

CVE:CVE-2025-31866
Description:Missing Authorization vulnerability in Ship Depot ShipDepot for WooCommerce allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects ShipDepot for WooCommerce: from n/a through 1.2.19.
published:2025-04-01T15:16:28.680


Instruction: Please provide detailed information about CVE-2025-31867

CVE:CVE-2025-31867
Description:Authorization Bypass Through User-Controlled Key vulnerability in JoomSky JS Job Manager allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects JS Job Manager: from n/a through 2.0.2.
published:2025-04-01T15:16:28.820


Instruction: Please provide detailed information about CVE-2025-31868

CVE:CVE-2025-31868
Description:Missing Authorization vulnerability in JoomSky JS Job Manager allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects JS Job Manager: from n/a through 2.0.2.
published:2025-04-01T15:16:28.983


Instruction: Please provide detailed information about CVE-2025-31869

CVE:CVE-2025-31869
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Modernaweb Studio Black Widgets For Elementor allows Stored XSS. This issue affects Black Widgets For Elementor: from n/a through 1.3.9.
published:2025-04-01T15:16:29.130


Instruction: Please provide detailed information about CVE-2025-31870

CVE:CVE-2025-31870
Description:Missing Authorization vulnerability in EXEIdeas International WP AutoKeyword allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects WP AutoKeyword: from n/a through 1.0.
published:2025-04-01T15:16:29.273


Instruction: Please provide detailed information about CVE-2025-31871

CVE:CVE-2025-31871
Description:URL Redirection to Untrusted Site ('Open Redirect') vulnerability in Galaxy Weblinks WP Clone any post type allows Phishing. This issue affects WP Clone any post type: from n/a through 3.4.
published:2025-04-01T15:16:29.427


Instruction: Please provide detailed information about CVE-2025-31872

CVE:CVE-2025-31872
Description:Missing Authorization vulnerability in Galaxy Weblinks WP Clone any post type allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects WP Clone any post type: from n/a through 3.4.
published:2025-04-01T15:16:29.580


Instruction: Please provide detailed information about CVE-2025-31873

CVE:CVE-2025-31873
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in sheetdb SheetDB allows Stored XSS. This issue affects SheetDB: from n/a through 1.3.3.
published:2025-04-01T15:16:29.723


Instruction: Please provide detailed information about CVE-2025-31874

CVE:CVE-2025-31874
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Ajay WebberZone Snippetz allows Stored XSS. This issue affects WebberZone Snippetz: from n/a through 2.1.0.
published:2025-04-01T15:16:29.877


Instruction: Please provide detailed information about CVE-2025-31875

CVE:CVE-2025-31875
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Pluginic FancyPost allows DOM-Based XSS. This issue affects FancyPost: from n/a through 6.0.1.
published:2025-04-01T15:16:30.023


Instruction: Please provide detailed information about CVE-2025-31877

CVE:CVE-2025-31877
Description:Missing Authorization vulnerability in Magnigenie RestroPress allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects RestroPress: from n/a through 3.1.8.4.
published:2025-04-01T15:16:30.173


Instruction: Please provide detailed information about CVE-2025-31878

CVE:CVE-2025-31878
Description:Missing Authorization vulnerability in Dmitry V. (CEO of "UKR Solution") UPC/EAN/GTIN Code Generator allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects UPC/EAN/GTIN Code Generator: from n/a through 2.0.2.
published:2025-04-01T15:16:30.327


Instruction: Please provide detailed information about CVE-2025-31879

CVE:CVE-2025-31879
Description:Missing Authorization vulnerability in Dmitry V. (CEO of "UKR Solution") Barcode Generator for WooCommerce allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Barcode Generator for WooCommerce: from n/a through 2.0.4.
published:2025-04-01T15:16:30.477


Instruction: Please provide detailed information about CVE-2025-31880

CVE:CVE-2025-31880
Description:Cross-Site Request Forgery (CSRF) vulnerability in Stylemix Pearl allows Cross Site Request Forgery. This issue affects Pearl: from n/a through 1.3.9.
published:2025-04-01T15:16:30.617


Instruction: Please provide detailed information about CVE-2025-31881

CVE:CVE-2025-31881
Description:Missing Authorization vulnerability in Stylemix Pearl allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Pearl: from n/a through 1.3.9.
published:2025-04-01T15:16:30.760


Instruction: Please provide detailed information about CVE-2025-31882

CVE:CVE-2025-31882
Description:Missing Authorization vulnerability in WPWebinarSystem WebinarPress allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects WebinarPress: from n/a through 1.33.27.
published:2025-04-01T15:16:30.967


Instruction: Please provide detailed information about CVE-2025-31883

CVE:CVE-2025-31883
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPWebinarSystem WebinarPress allows Stored XSS. This issue affects WebinarPress: from n/a through 1.33.27.
published:2025-04-01T15:16:31.233


Instruction: Please provide detailed information about CVE-2025-31884

CVE:CVE-2025-31884
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WP CMS Ninja Norse Rune Oracle Plugin allows Stored XSS. This issue affects Norse Rune Oracle Plugin: from n/a through 1.4.3.
published:2025-04-01T15:16:31.390


Instruction: Please provide detailed information about CVE-2025-31885

CVE:CVE-2025-31885
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Daniel Floeter Hyperlink Group Block allows DOM-Based XSS. This issue affects Hyperlink Group Block: from n/a through 2.0.1.
published:2025-04-01T15:16:31.533


Instruction: Please provide detailed information about CVE-2025-31886

CVE:CVE-2025-31886
Description:Missing Authorization vulnerability in Repuso Social proof testimonials and reviews by Repuso allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Social proof testimonials and reviews by Repuso: from n/a through 5.21.
published:2025-04-01T15:16:31.680


Instruction: Please provide detailed information about CVE-2025-31887

CVE:CVE-2025-31887
Description:Missing Authorization vulnerability in zookatron MyBookProgress by Stormhill Media allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects MyBookProgress by Stormhill Media: from n/a through 1.0.8.
published:2025-04-01T15:16:31.823


Instruction: Please provide detailed information about CVE-2025-31888

CVE:CVE-2025-31888
Description:Cross-Site Request Forgery (CSRF) vulnerability in WPExperts.io WP Multistore Locator allows Cross Site Request Forgery. This issue affects WP Multistore Locator: from n/a through 2.5.2.
published:2025-04-01T15:16:31.960


Instruction: Please provide detailed information about CVE-2025-31890

CVE:CVE-2025-31890
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Mashi Simple Map No Api allows Stored XSS. This issue affects Simple Map No Api: from n/a through 1.9.
published:2025-04-01T15:16:32.113


Instruction: Please provide detailed information about CVE-2025-31891

CVE:CVE-2025-31891
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Gosign Gosign – Posts Slider Block allows Stored XSS. This issue affects Gosign – Posts Slider Block: from n/a through 1.1.0.
published:2025-04-01T15:16:32.250


Instruction: Please provide detailed information about CVE-2025-31892

CVE:CVE-2025-31892
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Themeum WP Crowdfunding allows Stored XSS. This issue affects WP Crowdfunding: from n/a through 2.1.13.
published:2025-04-01T15:16:32.400


Instruction: Please provide detailed information about CVE-2025-31894

CVE:CVE-2025-31894
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Infoway LLC Ebook Downloader allows Stored XSS. This issue affects Ebook Downloader: from n/a through 1.0.
published:2025-04-01T15:16:32.550


Instruction: Please provide detailed information about CVE-2025-31895

CVE:CVE-2025-31895
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in paulrosen ABC Notation allows Stored XSS. This issue affects ABC Notation: from n/a through 6.1.3.
published:2025-04-01T15:16:32.697


Instruction: Please provide detailed information about CVE-2025-31897

CVE:CVE-2025-31897
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Arrow Plugins Arrow Custom Feed for Twitter allows Stored XSS. This issue affects Arrow Custom Feed for Twitter: from n/a through 1.5.3.
published:2025-04-01T15:16:32.837


Instruction: Please provide detailed information about CVE-2025-31904

CVE:CVE-2025-31904
Description:Cross-Site Request Forgery (CSRF) vulnerability in Infoway LLC Ebook Downloader allows Cross Site Request Forgery. This issue affects Ebook Downloader: from n/a through 1.0.
published:2025-04-01T15:16:32.980


Instruction: Please provide detailed information about CVE-2025-31906

CVE:CVE-2025-31906
Description:Cross-Site Request Forgery (CSRF) vulnerability in ProfitShare.ro WP Profitshare allows Stored XSS. This issue affects WP Profitshare: from n/a through 1.4.9.
published:2025-04-01T15:16:33.117


Instruction: Please provide detailed information about CVE-2025-31908

CVE:CVE-2025-31908
Description:Cross-Site Request Forgery (CSRF) vulnerability in Sami Ahmed Siddiqui JSON Structuring Markup allows Stored XSS. This issue affects JSON Structuring Markup: from n/a through 0.1.
published:2025-04-01T15:16:33.260


Instruction: Please provide detailed information about CVE-2025-31910

CVE:CVE-2025-31910
Description:Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in reputeinfosystems BookingPress allows SQL Injection. This issue affects BookingPress: from n/a through 1.1.28.
published:2025-04-01T15:16:33.397


Instruction: Please provide detailed information about CVE-2025-21894

CVE:CVE-2025-21894
Description:In the Linux kernel, the following vulnerability has been resolved:  net: enetc: VFs do not support HWTSTAMP_TX_ONESTEP_SYNC  Actually ENETC VFs do not support HWTSTAMP_TX_ONESTEP_SYNC because only ENETC PF can access PMa_SINGLE_STEP registers. And there will be a crash if VFs are used to test one-step timestamp, the crash log as follows.  [  129.110909] Unable to handle kernel paging request at virtual address 00000000000080c0 [  129.287769] Call trace: [  129.290219]  enetc_port_mac_wr+0x30/0xec (P) [  129.294504]  enetc_start_xmit+0xda4/0xe74 [  129.298525]  enetc_xmit+0x70/0xec [  129.301848]  dev_hard_start_xmit+0x98/0x118
published:2025-04-01T16:15:19.777


Instruction: Please provide detailed information about CVE-2025-21895

CVE:CVE-2025-21895
Description:In the Linux kernel, the following vulnerability has been resolved:  perf/core: Order the PMU list to fix warning about unordered pmu_ctx_list  Syskaller triggers a warning due to prev_epc->pmu != next_epc->pmu in perf_event_swap_task_ctx_data(). vmcore shows that two lists have the same perf_event_pmu_context, but not in the same order.  The problem is that the order of pmu_ctx_list for the parent is impacted by the time when an event/PMU is added. While the order for a child is impacted by the event order in the pinned_groups and flexible_groups. So the order of pmu_ctx_list in the parent and child may be different.  To fix this problem, insert the perf_event_pmu_context to its proper place after iteration of the pmu_ctx_list.  The follow testcase can trigger above warning:   # perf record -e cycles --call-graph lbr -- taskset -c 3 ./a.out &  # perf stat -e cpu-clock,cs -p xxx // xxx is the pid of a.out   test.c   void main() {         int count = 0;         pid_t pid;          printf("%d running\n", getpid());         sleep(30);         printf("running\n");          pid = fork();         if (pid == -1) {                 printf("fork error\n");                 return;         }         if (pid == 0) {                 while (1) {                         count++;                 }         } else {                 while (1) {                         count++;                 }         }  }  The testcase first opens an LBR event, so it will allocate task_ctx_data, and then open tracepoint and software events, so the parent context will have 3 different perf_event_pmu_contexts. On inheritance, child ctx will insert the perf_event_pmu_context in another order and the warning will trigger.  [ mingo: Tidied up the changelog. ]
published:2025-04-01T16:15:19.883


Instruction: Please provide detailed information about CVE-2025-21896

CVE:CVE-2025-21896
Description:In the Linux kernel, the following vulnerability has been resolved:  fuse: revert back to __readahead_folio() for readahead  In commit 3eab9d7bc2f4 ("fuse: convert readahead to use folios"), the logic was converted to using the new folio readahead code, which drops the reference on the folio once it is locked, using an inferred reference on the folio. Previously we held a reference on the folio for the entire duration of the readpages call.  This is fine, however for the case for splice pipe responses where we will remove the old folio and splice in the new folio (see fuse_try_move_page()), we assume that there is a reference held on the folio for ap->folios, which is no longer the case.  To fix this, revert back to __readahead_folio() which allows us to hold the reference on the folio for the duration of readpages until either we drop the reference ourselves in fuse_readpages_end() or the reference is dropped after it's replaced in the page cache in the splice case. This will fix the UAF bug that was reported.
published:2025-04-01T16:15:19.987


Instruction: Please provide detailed information about CVE-2025-21897

CVE:CVE-2025-21897
Description:In the Linux kernel, the following vulnerability has been resolved:  sched_ext: Fix pick_task_scx() picking non-queued tasks when it's called without balance()  a6250aa251ea ("sched_ext: Handle cases where pick_task_scx() is called without preceding balance_scx()") added a workaround to handle the cases where pick_task_scx() is called without prececing balance_scx() which is due to a fair class bug where pick_taks_fair() may return NULL after a true return from balance_fair().  The workaround detects when pick_task_scx() is called without preceding balance_scx() and emulates SCX_RQ_BAL_KEEP and triggers kicking to avoid stalling. Unfortunately, the workaround code was testing whether @prev was on SCX to decide whether to keep the task running. This is incorrect as the task may be on SCX but no longer runnable.  This could lead to a non-runnable task to be returned from pick_task_scx() which cause interesting confusions and failures. e.g. A common failure mode is the task ending up with (!on_rq && on_cpu) state which can cause potential wakers to busy loop, which can easily lead to deadlocks.  Fix it by testing whether @prev has SCX_TASK_QUEUED set. This makes @prev_on_scx only used in one place. Open code the usage and improve the comment while at it.
published:2025-04-01T16:15:20.083


Instruction: Please provide detailed information about CVE-2025-21898

CVE:CVE-2025-21898
Description:In the Linux kernel, the following vulnerability has been resolved:  ftrace: Avoid potential division by zero in function_stat_show()  Check whether denominator expression x * (x - 1) * 1000 mod {2^32, 2^64} produce zero and skip stddev computation in that case.  For now don't care about rec->counter * rec->counter overflow because rec->time * rec->time overflow will likely happen earlier.
published:2025-04-01T16:15:20.190


Instruction: Please provide detailed information about CVE-2025-21899

CVE:CVE-2025-21899
Description:In the Linux kernel, the following vulnerability has been resolved:  tracing: Fix bad hist from corrupting named_triggers list  The following commands causes a crash:   ~# cd /sys/kernel/tracing/events/rcu/rcu_callback  ~# echo 'hist:name=bad:keys=common_pid:onmax(bogus).save(common_pid)' > trigger  bash: echo: write error: Invalid argument  ~# echo 'hist:name=bad:keys=common_pid' > trigger  Because the following occurs:  event_trigger_write() {   trigger_process_regex() {     event_hist_trigger_parse() {        data = event_trigger_alloc(..);        event_trigger_register(.., data) {         cmd_ops->reg(.., data, ..) [hist_register_trigger()] {           data->ops->init() [event_hist_trigger_init()] {             save_named_trigger(name, data) {               list_add(&data->named_list, &named_triggers);             }           }         }       }        ret = create_actions(); (return -EINVAL)       if (ret)         goto out_unreg; [..]       ret = hist_trigger_enable(data, ...) {         list_add_tail_rcu(&data->list, &file->triggers); <<<---- SKIPPED!!! (this is important!) [..]  out_unreg:       event_hist_unregister(.., data) {         cmd_ops->unreg(.., data, ..) [hist_unregister_trigger()] {           list_for_each_entry(iter, &file->triggers, list) {             if (!hist_trigger_match(data, iter, named_data, false))   <- never matches                 continue;             [..]             test = iter;           }           if (test && test->ops->free) <<<-- test is NULL              test->ops->free(test) [event_hist_trigger_free()] {               [..]               if (data->name)                 del_named_trigger(data) {                   list_del(&data->named_list);  <<<<-- NEVER gets removed!                 }               }            }          }           [..]          kfree(data); <<<-- frees item but it is still on list  The next time a hist with name is registered, it causes an u-a-f bug and the kernel can crash.  Move the code around such that if event_trigger_register() succeeds, the next thing called is hist_trigger_enable() which adds it to the list.  A bunch of actions is called if get_named_trigger_data() returns false. But that doesn't need to be called after event_trigger_register(), so it can be moved up, allowing event_trigger_register() to be called just before hist_trigger_enable() keeping them together and allowing the file->triggers to be properly populated.
published:2025-04-01T16:15:20.327


Instruction: Please provide detailed information about CVE-2025-21900

CVE:CVE-2025-21900
Description:In the Linux kernel, the following vulnerability has been resolved:  NFSv4: Fix a deadlock when recovering state on a sillyrenamed file  If the file is sillyrenamed, and slated for delete on close, it is possible for a server reboot to triggeer an open reclaim, with can again race with the application call to close(). When that happens, the call to put_nfs_open_context() can trigger a synchronous delegreturn call which deadlocks because it is not marked as privileged.  Instead, ensure that the call to nfs4_inode_return_delegation_on_close() catches the delegreturn, and schedules it asynchronously.
published:2025-04-01T16:15:20.440


Instruction: Please provide detailed information about CVE-2025-21901

CVE:CVE-2025-21901
Description:In the Linux kernel, the following vulnerability has been resolved:  RDMA/bnxt_re: Add sanity checks on rdev validity  There is a possibility that ulp_irq_stop and ulp_irq_start callbacks will be called when the device is in detached state. This can cause a crash due to NULL pointer dereference as the rdev is already freed.
published:2025-04-01T16:15:20.547


Instruction: Please provide detailed information about CVE-2025-21902

CVE:CVE-2025-21902
Description:In the Linux kernel, the following vulnerability has been resolved:  acpi: typec: ucsi: Introduce a ->poll_cci method  For the ACPI backend of UCSI the UCSI "registers" are just a memory copy of the register values in an opregion. The ACPI implementation in the BIOS ensures that the opregion contents are synced to the embedded controller and it ensures that the registers (in particular CCI) are synced back to the opregion on notifications. While there is an ACPI call that syncs the actual registers to the opregion there is rarely a need to do this and on some ACPI implementations it actually breaks in various interesting ways.  The only reason to force a sync from the embedded controller is to poll CCI while notifications are disabled. Only the ucsi core knows if this is the case and guessing based on the current command is suboptimal, i.e. leading to the following spurious assertion splat:  WARNING: CPU: 3 PID: 76 at drivers/usb/typec/ucsi/ucsi.c:1388 ucsi_reset_ppm+0x1b4/0x1c0 [typec_ucsi] CPU: 3 UID: 0 PID: 76 Comm: kworker/3:0 Not tainted 6.12.11-200.fc41.x86_64 #1 Hardware name: LENOVO 21D0/LNVNB161216, BIOS J6CN45WW 03/17/2023 Workqueue: events_long ucsi_init_work [typec_ucsi] RIP: 0010:ucsi_reset_ppm+0x1b4/0x1c0 [typec_ucsi] Call Trace:  <TASK>  ucsi_init_work+0x3c/0xac0 [typec_ucsi]  process_one_work+0x179/0x330  worker_thread+0x252/0x390  kthread+0xd2/0x100  ret_from_fork+0x34/0x50  ret_from_fork_asm+0x1a/0x30  </TASK>  Thus introduce a ->poll_cci() method that works like ->read_cci() with an additional forced sync and document that this should be used when polling with notifications disabled. For all other backends that presumably don't have this issue use the same implementation for both methods.
published:2025-04-01T16:15:20.650


Instruction: Please provide detailed information about CVE-2025-21903

CVE:CVE-2025-21903
Description:In the Linux kernel, the following vulnerability has been resolved:  mctp i3c: handle NULL header address  daddr can be NULL if there is no neighbour table entry present, in that case the tx packet should be dropped.  saddr will usually be set by MCTP core, but check for NULL in case a packet is transmitted by a different protocol.
published:2025-04-01T16:15:20.757


Instruction: Please provide detailed information about CVE-2025-21904

CVE:CVE-2025-21904
Description:In the Linux kernel, the following vulnerability has been resolved:  caif_virtio: fix wrong pointer check in cfv_probe()  del_vqs() frees virtqueues, therefore cfv->vq_tx pointer should be checked for NULL before calling it, not cfv->vdev. Also the current implementation is redundant because the pointer cfv->vdev is dereferenced before it is checked for NULL.  Fix this by checking cfv->vq_tx for NULL instead of cfv->vdev before calling del_vqs().
published:2025-04-01T16:15:20.857


Instruction: Please provide detailed information about CVE-2025-21905

CVE:CVE-2025-21905
Description:In the Linux kernel, the following vulnerability has been resolved:  wifi: iwlwifi: limit printed string from FW file  There's no guarantee here that the file is always with a NUL-termination, so reading the string may read beyond the end of the TLV. If that's the last TLV in the file, it can perhaps even read beyond the end of the file buffer.  Fix that by limiting the print format to the size of the buffer we have.
published:2025-04-01T16:15:20.980


Instruction: Please provide detailed information about CVE-2025-21906

CVE:CVE-2025-21906
Description:In the Linux kernel, the following vulnerability has been resolved:  wifi: iwlwifi: mvm: clean up ROC on failure  If the firmware fails to start the session protection, then we do call iwl_mvm_roc_finished() here, but that won't do anything at all because IWL_MVM_STATUS_ROC_P2P_RUNNING was never set. Set IWL_MVM_STATUS_ROC_P2P_RUNNING in the failure/stop path. If it started successfully before, it's already set, so that doesn't matter, and if it didn't start it needs to be set to clean up.  Not doing so will lead to a WARN_ON() later on a fresh remain- on-channel, since the link is already active when activated as it was never deactivated.
published:2025-04-01T16:15:21.110


Instruction: Please provide detailed information about CVE-2025-21907

CVE:CVE-2025-21907
Description:In the Linux kernel, the following vulnerability has been resolved:  mm: memory-failure: update ttu flag inside unmap_poisoned_folio  Patch series "mm: memory_failure: unmap poisoned folio during migrate properly", v3.  Fix two bugs during folio migration if the folio is poisoned.   This patch (of 3):  Commit 6da6b1d4a7df ("mm/hwpoison: convert TTU_IGNORE_HWPOISON to TTU_HWPOISON") introduce TTU_HWPOISON to replace TTU_IGNORE_HWPOISON in order to stop send SIGBUS signal when accessing an error page after a memory error on a clean folio.  However during page migration, anon folio must be set with TTU_HWPOISON during unmap_*().  For pagecache we need some policy just like the one in hwpoison_user_mappings to set this flag.  So move this policy from hwpoison_user_mappings to unmap_poisoned_folio to handle this warning properly.  Warning will be produced during unamp poison folio with the following log:    ------------[ cut here ]------------   WARNING: CPU: 1 PID: 365 at mm/rmap.c:1847 try_to_unmap_one+0x8fc/0xd3c   Modules linked in:   CPU: 1 UID: 0 PID: 365 Comm: bash Tainted: G        W          6.13.0-rc1-00018-gacdb4bbda7ab #42   Tainted: [W]=WARN   Hardware name: QEMU QEMU Virtual Machine, BIOS 0.0.0 02/06/2015   pstate: 20400005 (nzCv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--)   pc : try_to_unmap_one+0x8fc/0xd3c   lr : try_to_unmap_one+0x3dc/0xd3c   Call trace:    try_to_unmap_one+0x8fc/0xd3c (P)    try_to_unmap_one+0x3dc/0xd3c (L)    rmap_walk_anon+0xdc/0x1f8    rmap_walk+0x3c/0x58    try_to_unmap+0x88/0x90    unmap_poisoned_folio+0x30/0xa8    do_migrate_range+0x4a0/0x568    offline_pages+0x5a4/0x670    memory_block_action+0x17c/0x374    memory_subsys_offline+0x3c/0x78    device_offline+0xa4/0xd0    state_store+0x8c/0xf0    dev_attr_store+0x18/0x2c    sysfs_kf_write+0x44/0x54    kernfs_fop_write_iter+0x118/0x1a8    vfs_write+0x3a8/0x4bc    ksys_write+0x6c/0xf8    __arm64_sys_write+0x1c/0x28    invoke_syscall+0x44/0x100    el0_svc_common.constprop.0+0x40/0xe0    do_el0_svc+0x1c/0x28    el0_svc+0x30/0xd0    el0t_64_sync_handler+0xc8/0xcc    el0t_64_sync+0x198/0x19c   ---[ end trace 0000000000000000 ]---  [mawupeng1@huawei.com: unmap_poisoned_folio(): remove shadowed local `mapping', per Miaohe]   Link: https://lkml.kernel.org/r/20250219060653.3849083-1-mawupeng1@huawei.com
published:2025-04-01T16:15:21.217