def __plugin_cves(data, db):
    """
    Get CVEs of a plugin

    :param data: PlecostDatabaseQuery object
    :type data: PlecostDatabaseQuery

    :return: results of query
    :rtype: str
    """
    _plugin = data.parameter
    _query = (
        'SELECT DISTINCT(cve) FROM PLUGIN_VULNERABILITIES_CVE as PV, (SELECT DISTINCT(plugin_name), _id FROM PLUGIN_VULNERABILITIES WHERE plugin_name LIKE ?) as PN WHERE PN._id == PV._id'
        )
    _query_versions = (
        'SELECT DISTINCT(plugin_version) FROM PLUGIN_VULNERABILITIES AS PV, PLUGIN_VULNERABILITIES_CVE AS PC WHERE PV._id == PC._id AND PC.cve like ?;'
        )
    res = []
    res_append = res.append
    res_append("[*] Associated CVEs for plugin '%s':\n" % _plugin)
    for i, x in enumerate(db.raw(query=_query, parameters=(_plugin,)).
        fetchall()):
        _cve = x[0]
        res_append('    { %s } - %s:\n' % (i, _cve))
        res_append('             Affected versions:\n')
        for j, v in enumerate(db.raw(_query_versions, parameters=(_cve,)).
            fetchall()):
            _version = v[0]
            res_append('             <%s> - %s' % (j, _version))
    res_append('\n')
    return '\n'.join(res)
