Search vulnerabilities

Expected end of text, found 'ć' (at char 17), (line:1, col:18)
Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 425,120

CVE-2021-24722

Restaurant Menu by MotoPress < 2.4.2 - Admin+ Stored Cross Site Scripting

The Restaurant Menu by MotoPress WordPress plugin before 2.4.2 does not properly sanitize or escape inputs when creating new menu items, which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed

CVSS 3.1 · 4.8 Medium EPSS < 1% KEV · Not listed
Vendors
Motopress
Products
Restaurant Menu
CVE-2021-24721

Loco Translate < 2.5.4 - Authenticated PHP Code Injection

The Loco Translate WordPress plugin before 2.5.4 mishandles data inputs which get saved to a file, which can be renamed to an extension ending in .php, resulting in authenticated "translator" users being able to inject PHP code into files ending with .php in web accessible locations.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Loco Translate Project
Products
Loco Translate
CVE-2021-24720

GeoDirectory < 2.1.1.3 - Authenticated Stored Cross-Site Scripting (XSS)

The GeoDirectory Business Directory WordPress plugin before 2.1.1.3 was vulnerable to Authenticated Stored Cross-Site Scripting (XSS).

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed
Vendors
Ayecode
Products
Geodirectory
CVE-2021-24719

Enfold Theme < 4.8.4 - Reflected Cross-Site Scripting (XSS)

The Enfold Enfold WordPress theme before 4.8.4 was vulnerable to Reflected Cross-Site Scripting (XSS). The vulnerability is present on Enfold versions previous than 4.8.4 which use Avia Page Builder.

CVSS 3.1 · 6.1 Medium EPSS 3.0% KEV · Not listed
Vendors
Kriesi
Products
Enfold
CVE-2021-24718

ARForms Form Builder < 1.5 - Admin+ Stored Cross Site Scripting

The Contact Form, Survey & Popup Form Plugin for WordPress plugin before 1.5 does not properly sanitize some of its settings allowing high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed

CVSS 3.1 · 4.8 Medium EPSS < 1% KEV · Not listed
Vendors
Reputeinfosystems
Products
Contact Form\, Survey \& Popup Form Plugin For Wordpress - Arforms Form Builder
CVE-2021-24717

AutomatorWP < 1.7.6 - Missing Authorization and Privilege Escalation

The AutomatorWP WordPress plugin before 1.7.6 does not perform capability checks which allows users with Subscriber roles to enumerate automations, disclose title of private posts or user emails, call functions, or perform privilege escalation via Ajax actions.

CVSS 3.1 · 8.8 High EPSS 1.3% KEV · Not listed
Vendors
Automatorwp
Products
Automatorwp
CVE-2021-24716

Modern Events Calendar Lite < 5.22.3 - Authenticated Stored Cross Site Scripting

The Modern Events Calendar Lite WordPress plugin before 5.22.3 does not properly sanitize or escape values set by users with access to adjust settings withing wp-admin.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed
Vendors
Webnus
Products
Modern Events Calendar Lite
CVE-2021-24715

WP Sitemap Page < 1.7.0 - Admin+ Stored Cross Site Scripting

The WP Sitemap Page WordPress plugin before 1.7.0 does not properly sanitise and escape some of its settings, which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed.

CVSS 3.1 · 4.8 Medium EPSS < 1% KEV · Not listed
Vendors
Wp Sitemap Page Project
Products
Wp Sitemap Page
CVE-2021-24714

WP All Import < 3.6.3 - Admin+ Stored Cross-Site Scripting

The Import any XML or CSV File to WordPress plugin before 3.6.3 does not escape the Import's Title and Unique Identifier fields before outputting them in admin pages, which could allow high privilege users to perform Cross-Site attacks even when the unfiltered_html capability is disallowed.

CVSS 3.1 · 4.8 Medium EPSS < 1% KEV · Not listed
Vendors
Soflyy
Products
Wp All Import
CVE-2021-24712

Appointment Hour Booking – WordPress Booking Plugin < 1.3.17 - Authenticated Stored XSS

The Appointment Hour Booking WordPress plugin before 1.3.17 does not properly sanitize values used when creating new calendars.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed
Vendors
Dwbooster
Products
Appointment Hour Booking
CVE-2021-24711

Software License Manager < 4.5.1 - Arbitrary Domain Deletion via CSRF

The del_reistered_domains AJAX action of the Software License Manager WordPress plugin before 4.5.1 does not have any CSRF checks, and is vulnerable to a CSRF attack

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed
Vendors
Tipsandtricks-hq
Products
Software License Manager
CVE-2021-24710

Print-O-Matic < 2.0.3 - Admin+ Stored Cross-Site Scripting

The Print-O-Matic WordPress plugin before 2.0.3 does not escape some of its settings before outputting them in attribute, which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed.

CVSS 3.1 · 4.8 Medium EPSS < 1% KEV · Not listed
Vendors
Print-o-matic Project
Products
Print-o-matic
CVE-2021-24709

Weather Effect < 1.3.6 - Admin+ Stored Cross-Site Scripting

The Weather Effect WordPress plugin before 1.3.6 does not properly validate and escape some of its settings (like *_size_leaf, *_flakes_leaf, *_speed) which could lead to Stored Cross-Site Scripting issues

CVSS 3.1 · 4.8 Medium EPSS < 1% KEV · Not listed
Vendors
Awplife
Products
Weather Effect
CVE-2021-24708

WP All Export < 1.3.1 - Admin+ Stored Cross-Site Scripting

The Export any WordPress data to XML/CSV WordPress plugin before 1.3.1 does not escape its Export's Name before outputting it in Manage Exports settings, which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed

CVSS 3.1 · 4.8 Medium EPSS < 1% KEV · Not listed
Vendors
Wp All Export Project
Products
Wp All Export
CVE-2021-24707

Learning Courses < 5.0 - Admin+ Stored Cross-Site Scripting

The Learning Courses WordPress plugin before 5.0 does not sanitise and escape the Email PDT identity token settings, which could allow high privilege users to perform cross-Site Scripting attacks even when the unfiltered_html capability is disallowed

CVSS 3.1 · 4.8 Medium EPSS < 1% KEV · Not listed
Vendors
Nd-learning Project
Products
Nd-learning
CVE-2021-24706

Qwizcards < 3.62 - Admin+ Stored Cross Site Scripting

The Qwizcards – online quizzes and flashcards WordPress plugin before 3.62 does not properly sanitize and escape some of its settings, allowing high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed.

CVSS 3.1 · 4.8 Medium EPSS < 1% KEV · Not listed
Vendors
Qwizcards Project
Products
Qwizcards
CVE-2021-24705

NEX-Forms < 8.4.3 - Stored Cross-Site Scripting via CSRF

The NEX-Forms WordPress plugin before 8.4.3 does not have CSRF checks in place when editing a form, and does not escape some of its settings as well as form fields before outputting them in attributes. This could allow attackers to make a logged in admin edit arbitrary forms with Cross-Site Scripting payloads in them

CVSS 3.1 · 4.8 Medium EPSS < 1% KEV · Not listed
Vendors
Basixonline
Products
Nex-forms
CVE-2021-24704

Orange Form <= 1.0 - SQL Injection via CSRF

In the Orange Form WordPress plugin through 1.0, the process_bulk_action() function in "admin/orange-form-email.php" performs an unprepared SQL query with an unsanitized parameter ($id). Only admin can access the page that invokes the function, but because of lack of CSRF protection, it is actually exploitable and could allow attackers to make a logged in admin delete arbitrary posts for example

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed
Vendors
Orange-form Project
Products
Orange-form
CVE-2021-24703

Download Plugin < 1.6.1 - Subscriber+ Arbitrary Plugin Activation

The Download Plugin WordPress plugin before 1.6.1 does not have capability and CSRF checks in the dpwap_plugin_activate AJAX action, allowing any authenticated users, such as subscribers, to activate plugins that are already installed.

CVSS 3.1 · 5.7 Medium EPSS < 1% KEV · Not listed
Vendors
Metagauss
Products
Download Plugin
CVE-2021-24702

LearnPress < 4.1.3.1 - Multiple Admin+ Stored Cross-Site Scripting

The LearnPress WordPress plugin before 4.1.3.1 does not properly sanitize or escape various inputs within course settings, which could allow high privilege users to perform Cross-Site Scripting attacks when the unfiltred_html capability is disallowed

CVSS 3.1 · 4.8 Medium EPSS < 1% KEV · Not listed
Vendors
Thimpress
Products
Learnpress