Search vulnerabilities

Expected end of text, found 'ć' (at char 17), (line:1, col:18)
Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 425,120

CVE-2021-24661

PostX Gutenberg Blocks Saved Templates Addon < 2.4.10 - Private Content Disclosure

The PostX – Gutenberg Blocks for Post Grid WordPress plugin before 2.4.10, with Saved Templates Addon enabled, allows users with Contributor roles or higher to read password-protected or private post contents the user is otherwise unable to read, given the post ID.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed
Vendors
Wpxpo
Products
Postx - Gutenberg Blocks For Post Grid
CVE-2021-24660

PostX Gutenberg Blocks Saved Templates Addon < 2.4.10 - Contributor+ Stored Cross-Site Scripting

The PostX – Gutenberg Blocks for Post Grid WordPress plugin before 2.4.10, with Saved Templates Addon enabled, allows users with a role as low as Contributor to perform Stored Cross-Site Scripting attacks via the plugin's shortcode.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed
Vendors
Wpxpo
Products
Postx - Gutenberg Blocks For Post Grid
CVE-2021-24659

PostX Gutenberg Blocks for Post Grid < 2.4.10 - Contributor+ Stored Cross-Site Scripting

The PostX – Gutenberg Blocks for Post Grid WordPress plugin before 2.4.10 allows users with a role as low as Contributor to perform Stored Cross-Site Scripting attacks via the plugin's block.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed
Vendors
Wpxpo
Products
Postx - Gutenberg Blocks For Post Grid
CVE-2021-24657

Limit Login Attempts < 4.0.50 - Unauthenticated Stored Cross-Site Scripting

The Limit Login Attempts WordPress plugin before 4.0.50 does not escape the IP addresses (which can be controlled by attacker via headers such as X-Forwarded-For) of attempted logins before outputting them in the reports table, leading to an Unauthenticated Stored Cross-Site Scripting issue.

CVSS 3.1 · 6.1 Medium EPSS 1.6% KEV · Not listed
Vendors
Limit Login Attempts Project
Products
Limit Login Attempts
CVE-2021-24656

Simple Social Media Share Buttons < 3.2.4 - Authenticated Stored Cross-Site Scripting

The Simple Social Media Share Buttons WordPress plugin before 3.2.4 does not escape the Share Title settings before outputting it in the frontend pages or posts (depending on the settings used), allowing high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed.

CVSS 3.1 · 4.8 Medium EPSS < 1% KEV · Not listed
Vendors
Wpbrigade
Products
Simple Social Buttons
CVE-2021-24655

WP User Manager < 2.6.3 - Arbitrary User Password Reset to Account Compromise

The WP User Manager WordPress plugin before 2.6.3 does not ensure that the user ID to reset the password of is related to the reset key given. As a result, any authenticated user can reset the password (to an arbitrary value) of any user knowing only their ID, and gain access to their account.

CVSS 3.1 · 7.5 High EPSS 1.0% KEV · Not listed
Vendors
Wpusermanager
Products
Wp User Manager
CVE-2021-24654

User Registration < 2.0.2 - Low Privilege Stored Cross-Site Scripting

The User Registration WordPress plugin before 2.0.2 does not properly sanitise the user_registration_profile_pic_url value when submitted directly via the user_registration_update_profile_details AJAX action. This could allow any authenticated user, such as subscriber, to perform Stored Cross-Site attacks when their profile is viewed

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed
Vendors
Wpeverest
Products
User Registration
CVE-2021-24653

Cookie Bar < 1.8.9 - Admin+ Stored Cross-Site Scripting

The Cookie Bar WordPress plugin before 1.8.9 doesn't properly sanitise the Cookie Bar Message setting, which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed

CVSS 3.1 · 4.8 Medium EPSS < 1% KEV · Not listed
Vendors
Cookie-bar Project
Products
Cookie-bar
CVE-2021-24652

PostX Gutenberg Blocks for Post Grid < 2.4.10 - Missing Access Controls

The PostX – Gutenberg Blocks for Post Grid WordPress plugin before 2.4.10 performs incorrect checks before allowing any logged in user to perform some ajax based requests, allowing any user to modify, delete or add ultp_options values.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Wpxpo
Products
Postx - Gutenberg Blocks For Post Grid
CVE-2021-24651

Poll Maker < 3.4.2 - Unauthenticated Time Based SQL Injection

The Poll Maker WordPress plugin before 3.4.2 allows unauthenticated users to perform SQL injection via the ays_finish_poll AJAX action. While the result is not disclosed in the response, it is possible to use a timing attack to exfiltrate data such as password hash.

CVSS 3.1 · 7.5 High EPSS 1.6% KEV · Not listed
Vendors
Ays-pro
Products
Poll Maker
CVE-2021-24648

Registration Magic < 5.0.1.9 - Reflected Cross-Site Scripting

The RegistrationMagic WordPress plugin before 5.0.1.9 does not sanitise and escape the rm_search_value parameter before outputting back in an attribute, leading to a Reflected Cross-Site Scripting

CVSS 3.1 · 6.1 Medium EPSS < 1% KEV · Not listed
Vendors
Metagauss
Products
Registrationmagic
CVE-2021-24647

Pie Register < 3.7.1.6 - Unauthenticated Arbitrary Login

The Registration Forms – User profile, Content Restriction, Spam Protection, Payment Gateways, Invitation Codes WordPress plugin before 3.1.7.6 has a flaw in the social login implementation, allowing unauthenticated attacker to login as any user on the site by only knowing their user ID or username

CVSS 3.1 · 8.1 High EPSS 9.8% KEV · Not listed
Vendors
Genetechsolutions
Products
Pie Register
CVE-2021-24646

Booking.com Banner Creator < 1.4.3 - Admin+ Stored Cross-Site Scripting

The Booking.com Banner Creator WordPress plugin before 1.4.3 does not properly sanitize inputs when creating banners, which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed

CVSS 3.1 · 4.8 Medium EPSS < 1% KEV · Not listed
Vendors
Bookingholdings
Products
Booking.com Banner Creator
CVE-2021-24645

Booking.com Product Helper < 1.0.2 - Admin+ Stored Cross-Site Scripting

The Booking.com Product Helper WordPress plugin before 1.0.2 does not sanitize and escape Product Code when creating Product Shortcode, which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed

CVSS 3.1 · 4.8 Medium EPSS < 1% KEV · Not listed
Vendors
Bookingholdings
Products
Booking.com Product Helper
CVE-2021-24644

Images to WebP < 1.9 - Authenticated Local File Inclusion

The Images to WebP WordPress plugin before 1.9 does not validate or sanitise the tab parameter before passing it to the include() function, which could lead to a Local File Inclusion issue

CVSS 3.1 · 7.5 High EPSS 5.9% KEV · Not listed
Vendors
Imagestowebp Project
Products
Images To Webp
CVE-2021-24643

WP Map Block < 1.2.3 - Contributor+ Stored Cross-Site Scripting

The WP Map Block WordPress plugin before 1.2.3 does not escape some attributes of the WP Map Block, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed
Vendors
Wp Map Block Project
Products
Wp Map Block
CVE-2021-24642

Scroll Baner <= 1.0 - CSRF to RCE

The Scroll Baner WordPress plugin through 1.0 does not have CSRF check in place when saving its settings, nor perform any sanitisation, escaping or validation on them. This could allow attackers to make logged in admin change them and could lead to RCE (via a file upload) as well as XSS

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Scroll Banner Project
Products
Scroll Banner
CVE-2021-24641

Images to WebP < 1.9 - Multiple Cross Site Request Forgery (CSRF)

The Images to WebP WordPress plugin before 1.9 does not have CSRF checks in place when performing some administrative actions, which could result in modification of plugin settings, Denial-of-Service, as well as arbitrary image conversion

CVSS 3.1 · 8.1 High EPSS < 1% KEV · Not listed
Vendors
Imagestowebp Project
Products
Images To Webp
CVE-2021-24640

Gutenslider < 5.2.0 - Contributor+ Stored XSS

The WordPress Slider Block Gutenslider plugin before 5.2.0 does not escape the minWidth attribute of a Gutenburg block, which could allow users with a role as low as contributor to perform Cross-Site Scripting attacks

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed
Vendors
Gutenslider
Products
Gutenslider