CVE-2021-24743

Podcast Subscribe Buttons < 1.4.2 - Contributor+ Stored XSS

The Podcast Subscribe Buttons WordPress plugin before 1.4.2 allows users with any role capable of editing or adding posts to perform stored XSS.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed

Vendors

Secondlinethemes

Products

Podcast Subscribe Buttons

CVE-2021-24742

Logo Slider and Showcase < 1.3.37 - Editor Plugin's Settings Update

The Logo Slider and Showcase WordPress plugin before 1.3.37 allows Editor users to update the plugin's settings via the rtWLSSettings AJAX action because it uses a nonce for authorisation instead of a capability check.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Radiustheme

Products

Logo Slider And Showcase

CVE-2021-24741

Support Board < 3.3.4 - Multiple Unauthenticated SQL Injections

The Support Board WordPress plugin before 3.3.4 does not escape multiple POST parameters (such as status_code, department, user_id, conversation_id, conversation_status_code, and recipient_id) before using them in SQL statements, leading to SQL injections which are exploitable by unauthenticated users.

CVSS 3.1 · 9.8 Critical EPSS 5.6% KEV · Not listed

Vendors

Schiocco

Products

Support Board - Chat And Help Desk

CVE-2021-24740

Tutor LMS < 1.9.9 - Multiple Admin+ Stored Cross-Site Scripting

The Tutor LMS WordPress plugin before 1.9.9 does not escape some of its settings before outputting them in attributes, which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed.

CVSS 3.1 · 4.8 Medium EPSS < 1% KEV · Not listed

Vendors

Themeum

Products

Tutor Lms

CVE-2021-24739

Logo Carousel < 3.4.2 - Unauthorised Private Post Access

The Logo Carousel WordPress plugin before 3.4.2 allows users with a role as low as Contributor to duplicate and view arbitrary private posts made by other users via the Carousel Duplication feature

CVSS 3.1 · 8.1 High EPSS 1.0% KEV · Not listed

Vendors

Shapedplugin

Products

Logo Carousel

CVE-2021-24738

Logo Carousel < 3.4.2 - Contributor+ Stored Cross-Site Scripting

The Logo Carousel WordPress plugin before 3.4.2 does not validate and escape the "Logo Margin" carousel option, which could allow users with a role as low as Contributor to perform Stored Cross-Site Scripting attacks

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed

Vendors

Shapedplugin

Products

Logo Carousel

CVE-2021-24737

Comments - wpDiscuz <= 7.3.0 - Admin+ Stored Cross-Site Scripting

The Comments – wpDiscuz WordPress plugin through 7.3.0 does not properly sanitise or escape the Follow and Unfollow messages before outputting them in the page, which could allow high privilege users to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed.

CVSS 3.1 · 4.8 Medium EPSS < 1% KEV · Not listed

Vendors

Gvectors

Products

Wpdiscuz

CVE-2021-24736

Shared Files < 1.6.57 - Admin+ Stored Cross-Site Scripting

The Easy Download Manager and File Sharing Plugin with frontend file upload – a better Media Library — Shared Files WordPress plugin before 1.6.57 does not sanitise and escape some of its settings before outputting them in attributes, which could lead to Stored Cross-Site Scripting issues.

CVSS 3.1 · 4.8 Medium EPSS < 1% KEV · Not listed

Vendors

Tammersoft

Products

Shared Files

CVE-2021-24735

Compact WP Audio Player < 1.9.7 - Setting Change via CSRF

The Compact WP Audio Player WordPress plugin before 1.9.7 does not implement nonce checks, which could allow attackers to make a logged in admin change the "Disable Simultaneous Play" setting via a CSRF attack.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Tipsandtricks-hq

Products

Compact Wp Audio Player

CVE-2021-24734

Compact WP Audio Player < 1.9.7 - Contributor+ Stored Cross-Site Scripting

The Compact WP Audio Player WordPress plugin before 1.9.7 does not escape some of its shortcodes attributes, which could allow users with a role as low as Contributor to perform Stored Cross-Site Scripting attacks.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed

Vendors

Tipsandtricks-hq

Products

Compact Wp Audio Player

CVE-2021-24733

WP Post Page Clone < 1.2 - Unauthorised Post Access

The WP Post Page Clone WordPress plugin before 1.2 allows users with a role as low as Contributor to clone and view other users' draft and password-protected posts which they cannot view normally.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed

Vendors

Wp Post Page Clone Project

Products

Wp Post Page Clone

CVE-2021-24732

Dflip Lite < 1.7.10 - Contributor+ Stored Cross-Site Scripting

The PDF Flipbook, 3D Flipbook WordPress – DearFlip WordPress plugin before 1.7.10 does not escape the class attribute of its shortcode before outputting it back in an attribute, which could allow users with a role as low as Contributor to perform Stored Cross-Site Scripting attacks

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed

Vendors

Dearhive

Products

Dearflip

CVE-2021-24731

Pie Register < 3.7.1.6 - Unauthenticated SQL Injection

The Registration Forms – User profile, Content Restriction, Spam Protection, Payment Gateways, Invitation Codes WordPress plugin before 3.7.1.6 does not properly escape user data before using it in a SQL statement in the wp-json/pie/v1/login REST API endpoint, leading to an SQL injection.

CVSS 3.1 · 9.8 Critical EPSS 6.4% KEV · Not listed

Vendors

Genetechsolutions

Products

Pie Register

CVE-2021-24730

Logo Showcase with Slick Slider < 1.2.5 - Subscriber+ Arbitrary Media Title/Description/Alt Text/URL Update

The Logo Showcase with Slick Slider WordPress plugin before 1.2.5 does not have CSRF and authorisation checks in the lswss_save_attachment_data AJAX action, allowing any authenticated users, such as Subscriber, to change title, description, alt text, and URL of arbitrary uploaded media.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed

Vendors

Infornweb

Products

Logo Showcase With Slick Slider

CVE-2021-24729

Logo Showcase with Slick Slider < 1.2.4 - Author+ Stored Cross Site Scripting

The Logo Showcase with Slick Slider WordPress plugin before 1.2.4 does not sanitise the Grid Settings, which could allow users with a role as low as Author to perform stored Cross-Site Scripting attacks via post metadata of Grid logo showcase.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed

Vendors

Infornweb

Products

Logo Showcase With Slick Slider

CVE-2021-24728

Paid Member Subscriptions < 2.4.2 - Authenticated SQL Injection

The Membership & Content Restriction – Paid Member Subscriptions WordPress plugin before 2.4.2 did not sanitise, validate or escape its order and orderby parameters before using them in SQL statement, leading to Authenticated SQL Injections in the Members and Payments pages.

CVSS 3.1 · 8.8 High EPSS 1.7% KEV · Not listed

Vendors

Cozmoslabs

Products

Membership \& Content Restriction - Paid Member Subscriptions

CVE-2021-24726

WP Simple Booking Calendar <= 2.0.6 (before 07/12/2021) - Authenticated SQL Injection

The WP Simple Booking Calendar WordPress plugin before 2.0.6 did not escape, validate or sanitise the orderby parameter in its Search Calendars action, before using it in a SQL statement, leading to an authenticated SQL injection issue

CVSS 3.1 · 8.8 High EPSS 1.6% KEV · Not listed

Vendors

Wpsimplebookingcalendar

Products

Wp Simple Booking Calendar

CVE-2021-24725

Comment Link Remove and Other Comment Tools < 2.1.6 - Arbitrary Comment Deletion via CSRF

The Comment Link Remove and Other Comment Tools WordPress plugin before 2.1.6 does not have CSRF check in its 'Delete comments easily', which could allow attackers to make logged in admin delete arbitrary comments

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed

Vendors

Quantumcloud

Products

Comment Link Remove And Other Comment Tools

CVE-2021-24724

Timetable and Event Schedule by MotoPress < 2.3.19 - Author+ Stored Cross-Site Scripting

The Timetable and Event Schedule by MotoPress WordPress plugin before 2.3.19 does not sanitise some of its parameters, which could allow low privilege users such as author to perform XSS attacks against frontend and backend users when viewing the related event/s

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed

Vendors

Motopress

Products

Timetable And Event Schedule

CVE-2021-24723

WP Reactions Lite < 1.3.6 - Authenticated Stored Cross Site Scripting

The WP Reactions Lite WordPress plugin before 1.3.6 does not properly sanitize inputs within wp-admin pages, allowing users with sufficient access to inject XSS payloads within /wp-admin/ pages.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed

Vendors

Wpreactions

Products

Wp Reactions Lite