CVE-2021-24602

HM Multiple Roles < 1.3 - Arbitrary Role Change

The HM Multiple Roles WordPress plugin before 1.3 does not have any access control to prevent low privilege users to set themselves as admin via their profile page

CVSS 3.1 · 8.8 High EPSS 1.5% KEV · Not listed

Vendors

Hmplugin

Products

Hm Multiple Roles

CVE-2021-24601

WPFront Notification Bar < 2.1.0.08087 - Authenticated Stored XSS

The WPFront Notification Bar WordPress plugin before 2.1.0.08087 does not properly sanitise and escape its settings, which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed

Vendors

Wpfront

Products

Wpfront Notification Bar

CVE-2021-24600

WP Dialog <= 1.2.5.5 - Authenticated Stored Cross-Site Scripting

The WP Dialog WordPress plugin through 1.2.5.5 does not sanitise and escape some of its settings before outputting them in pages, allowing high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed.

CVSS 3.1 · 4.8 Medium EPSS < 1% KEV · Not listed

Vendors

Wp Dialog Project

Products

Wp Dialog

CVE-2021-24599

Email Encoder < 2.1.2 - Reflected Cross Site Scripting

The Email Encoder – Protect Email Addresses WordPress plugin before 2.1.2 has an endpoint that requires no authentication and will render a user supplied value in the HTML response without escaping or sanitizing the data.

CVSS 3.1 · 6.1 Medium EPSS < 1% KEV · Not listed

Vendors

Wp-webhooks

Products

Email Encoder

CVE-2021-24598

Testimonial Builder < 1.6.0 - Admin+ Stored Cross-Site Scripting

The Testimonial WordPress plugin before 1.6.0 does not escape some testimonial fields which could allow high privilege users to perform Cross Site Scripting attacks even when the unfiltered_html capability is disallowed

CVSS 3.1 · 4.8 Medium EPSS < 1% KEV · Not listed

Vendors

Wpshopmart

Products

Testimonial Builder

CVE-2021-24597

You Shang <= 1.0.1 - Authenticated Stored Cross-Site Scripting

The You Shang WordPress plugin through 1.0.1 does not escape its qrcode links settings, which result into Stored Cross-Site Scripting issues in frontend posts and the plugins settings page depending on the payload used

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed

Vendors

You-shang Project

Products

You-shang

CVE-2021-24596

youForms for WordPress <= 1.0.5 - Authenticated Stored Cross-Site Scripting

The youForms for WordPress plugin through 1.0.5 does not sanitise escape the Button Text field of its Templates, allowing high privilege users (editors and admins) to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed

CVSS 3.1 · 4.8 Medium EPSS 2.8% KEV · Not listed

Vendors

Itservicejung

Products

Youforms-free-for-copecart

CVE-2021-24595

WP Cookie Choice <= 1.1.0 - CSRF to Stored Cross-Site Scripting

The Wp Cookie Choice WordPress plugin through 1.1.0 is lacking any CSRF check when saving its options, and do not escape them when outputting them in attributes. As a result, an attacker could make a logged in admin change them to arbitrary values including XSS payloads via a CSRF attack.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Wp Cookie Choice Project

Products

Wp Cookie Choice

CVE-2021-24594

Translate WordPress - Google Language Translator < 6.0.12 - Admin+ Stored Cross-Site Scripting

The Translate WordPress – Google Language Translator WordPress plugin before 6.0.12 does not sanitise and escape some of its settings before outputting it in various pages, allowing high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed.

CVSS 3.1 · 4.8 Medium EPSS < 1% KEV · Not listed

Vendors

Gtranslate

Products

Google Language Translator

CVE-2021-24593

Business Hours Indicator < 2.3.5 - Authenticated Stored XSS

The Business Hours Indicator WordPress plugin before 2.3.5 does not sanitise or escape its 'Now closed message" setting when outputting it in the backend and frontend, leading to an Authenticated Stored Cross-Site Scripting issue

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed

Vendors

Business Hours Indicator Project

Products

Business Hours Indicator

CVE-2021-24592

Sitewide Notice WP < 2.3 - Authenticated Stored XSS

The Sitewide Notice WP WordPress plugin before 2.3 does not sanitise some of its settings before outputting them in frontend pages, allowing high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed

CVSS 3.1 · 4.8 Medium EPSS < 1% KEV · Not listed

Vendors

Yoohooplugins

Products

Sitewide Notice

CVE-2021-24591

Highlight < 0.9.3 - Authenticated Stored Cross-Site Scripting

The Highlight WordPress plugin before 0.9.3 does not sanitise its CustomCSS setting, allowing high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed

Vendors

Dna88

Products

Highlight

CVE-2021-24590

Cookie Notice & Consent Banner for GDPR & CCPA Compliance < 1.7.2 - Authenticated Stored XSS

The Cookie Notice & Consent Banner for GDPR & CCPA Compliance WordPress plugin before 1.7.2 does not properly sanitize inputs to prevent injection of arbitrary HTML within the plugin's design customization options.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed

Vendors

Gdprinfo

Products

Cookie Notice \& Consent Banner For Gdpr \& Ccpa Compliance

CVE-2021-24588

SMS Alert Order Notifications – WooCommerce < 3.4.7 Authenticated Cross Site Scripting

The SMS Alert Order Notifications WordPress plugin before 3.4.7 is affected by a cross site scripting (XSS) vulnerability in the plugin's setting page.

CVSS 3.1 · 6.1 Medium EPSS < 1% KEV · Not listed

Vendors

Cozyvision

Products

Sms Alert Order Notifications

CVE-2021-24587

Splash Header < 1.20.8 - Authenticated Stored Cross-Site Scripting (XSS)

The Splash Header WordPress plugin before 1.20.8 doesn't sanitise and escape some of its settings while outputting them in the admin dashboard, leading to an authenticated Stored Cross-Site Scripting issue.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed

Vendors

Zeesweb

Products

Splash Header

CVE-2021-24586

Per Page Add to Head < 1.4.4 - CSRF to Stored XSS

The Per page add to head WordPress plugin before 1.4.4 is lacking any CSRF check when saving its settings, which could allow attackers to make a logged in admin change them. Furthermore, as the plugin allows arbitrary HTML to be inserted in one of the setting (feature mentioned by the plugin), this could lead to Stored XSS issue which will be triggered either in the backend, frontend or both depending on the payload used.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed

Vendors

Evona

Products

Per Page Add To Head

CVE-2021-24585

Timetable and Event Schedule by MotoPress < 2.4.0 - Arbitrary User's Hashed Password/Email/Username Disclosure

The Timetable and Event Schedule WordPress plugin before 2.4.0 outputs the Hashed Password, Username and Email Address (along other less sensitive data) of the user related to the Even Head of the Timeslot in the response when requesting the event Timeslot data with a user with the edit_posts capability. Combined with the other Unauthorised Event Timeslot Modification issue (https://wpscan.com/reports/submissions/4699/) where an arbitrary user ID can be set, this could allow low privilege users with the edit_posts capability (such as author) to retrieve sensitive User data by iterating over the user_id

CVSS 3.1 · 6.5 Medium EPSS 1.2% KEV · Not listed

Vendors

Motopress

Products

Timetable And Event Schedule

CVE-2021-24584

Timetable and Event Schedule by MotoPress < 2.4.2 - Unauthorised Event TimeSlot Update

The Timetable and Event Schedule WordPress plugin before 2.4.2 does not have proper access control when updating a timeslot, allowing any user with the edit_posts capability (contributor+) to update arbitrary timeslot from any events. Furthermore, no CSRF check is in place as well, allowing such attack to be perform via CSRF against a logged in with such capability. In versions before 2.3.19, the lack of sanitisation and escaping in some of the fields, like the descritption could also lead to Stored XSS issues

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed

Vendors

Motopress

Products

Timetable And Event Schedule

CVE-2021-24583

Timetable and Event Schedule by MotoPress < 2.4.2 - Unauthorised Event TimeSlot Deletion

The Timetable and Event Schedule WordPress plugin before 2.4.2 does not have proper access control when deleting a timeslot, allowing any user with the edit_posts capability (contributor+) to delete arbitrary timeslot from any events. Furthermore, no CSRF check is in place as well, allowing such attack to be performed via CSRF against a logged in with such capability

CVSS 3.1 · 4.3 Medium EPSS 1.6% KEV · Not listed

Vendors

Motopress

Products

Timetable And Event Schedule

CVE-2021-24582

ThinkTwit < 1.7.1 - Authenticated Stored Cross-Site Scripting (XSS)

The ThinkTwit WordPress plugin before 1.7.1 did not sanitise or escape its "Consumer key" setting before outputting it its settings page, leading to a Stored Cross-Site Scripting issue.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed

Vendors

Thinktwit Project

Products

Thinktwit