{"resultsPerPage":1,"startIndex":0,"totalResults":1,"format":"NVD_CVE","version":"2.0","timestamp":"2026-04-18T20:16:17.443","vulnerabilities":[{"cve":{"id":"CVE-2025-47531","sourceIdentifier":"audit@patchstack.com","published":"2025-05-07T15:16:10.197","lastModified":"2026-04-01T17:24:00.013","vulnStatus":"Modified","cveTags":[],"descriptions":[{"lang":"en","value":"Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Xylus Themes XT Event Widget for Social Events xt-facebook-events allows PHP Local File Inclusion.This issue affects XT Event Widget for Social Events: from n/a through <= 1.1.7."},{"lang":"es","value":"Vulnerabilidad de control inadecuado del nombre de archivo para declaraciones Include/Require en programas PHP ('Inclusión remota de archivos PHP') en Xylus Themes XT Event Widget for Social Events permite la inclusión local de archivos en PHP. Este problema afecta al widget de eventos XT para eventos sociales desde n/d hasta la versión 1.1.7."}],"metrics":{"cvssMetricV31":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":8.8,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":2.8,"impactScore":5.9}]},"weaknesses":[{"source":"audit@patchstack.com","type":"Secondary","description":[{"lang":"en","value":"CWE-98"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:xylusthemes:xt_event_widget_for_social_events:*:*:*:*:*:wordpress:*:*","versionEndExcluding":"1.1.8","matchCriteriaId":"D8560A32-7473-437E-8E7C-02254C27564C"}]}]}],"references":[{"url":"https://patchstack.com/database/Wordpress/Plugin/xt-facebook-events/vulnerability/wordpress-xt-event-widget-for-social-events-1-1-7-local-file-inclusion-vulnerability?_s_id=cve","source":"audit@patchstack.com","tags":["Third Party Advisory"]}]}}]}