NES-1108: A Gold Set of 1108 WordPress Plugin Vulnerabilities with Vulnerable/Patched Source and Diff-Based Ground Truth

NES-1108 is a benchmark of 1,108 real, disclosed-and-patched vulnerabilities across 854 unique WordPress plugins, curated from the Patchstack vulnerability database. It is intended for evaluating vulnerability detectors (static/taint analysis and LLM-based systems) on realistic WordPress plugin code. For every vulnerability the dataset provides:- the vulnerable and patched plugin source, as the originally released ZIP archives;- a vulnerability-class label from a 10-class taxonomy: SQL injection, cross-site scripting (XSS), broken access control, CSRF, PHP object injection, remote code execution, local file inclusion, SSRF, arbitrary file upload, and "other" (types outside classic source-to-sink taint scope);- CVSS score, affected and patched versions, disclosure date, and links to NVD and Patchstack;- diff-based ground truth: the PHP files that each security patch modified, which enables file-level localization evaluation. Contents:- plugins.rar - all plugin sources, organized as plugins/<slug>/<slug>.<version>-VULNERABLE.zip and ...-PATCHED.zip (854 plugin folders; about 8 GB uncompressed).- NES-1108-CVE-Dataset.xlsx and .csv - the catalogue of all 1,108 records, with clickable NVD and Patchstack links (Excel sheets: Read me, CVE List, Summary, Top plugins).- ground_truth.csv - the class labels.- README.md, CITATION.cff, HOW-TO-CITE.md, LICENSE, build_dataset.py - documentation, citation, license, and the catalogue-build script. Note on counts: there are 854 plugin folders but 1,108 vulnerabilities because 155 plugins have more than one CVE; those folders contain several version pairs. Use the Slug and version columns in the catalogue to map each record to its exact source ZIPs. Of the 1,108 records, 1,069 have an assigned CVE identifier and 39 are Patchstack advisories without a CVE (shown as "-").