CVE-2021-25093

Link Library < 7.2.8 - Unauthenticated Arbitrary Links Deletion

The Link Library WordPress plugin before 7.2.8 does not have authorisation in place when deleting links, allowing unauthenticated users to delete arbitrary links via a crafted request

CVSS 3.1 · 7.5 High EPSS 1.2% KEV · Not listed

Vendors

Ylefebvre

Products

Link Library

CVE-2021-25092

Link Library < 7.2.8 - Library Settings Reset via CSRF

The Link Library WordPress plugin before 7.2.8 does not have CSRF check when resetting library settings, allowing attackers to make a logged in admin reset arbitrary settings via a CSRF attack

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Ylefebvre

Products

Link Library

CVE-2021-25091

Link Library < 7.2.9 - Reflected Cross-Site Scripting

The Link Library WordPress plugin before 7.2.9 does not sanitise and escape the settingscopy parameter before outputting it back in an admin page, leading to a Reflected Cross-Site Scripting

CVSS 3.1 · 6.1 Medium EPSS < 1% KEV · Not listed

Vendors

Ylefebvre

Products

Link Library

CVE-2021-25090

GridKit Portfolio < 2.1.0 - Subscriber+ Stored Cross-Site Scripting

The Portfolio Gallery, Product Catalog WordPress plugin before 2.1.0 does not have authorisation and CSRF checks in various functions related to AJAX actions, allowing any authenticated users, such as subscriber, to call them. Due to the lack of sanitisation and escaping, it could also allows attackers to perform Cross-Site Scripting attacks on pages where a Portfolio is embed

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed

Vendors

Wpsofts

Products

Portfolio Gallery\, Product Catalog - Grid Kit Portfolio

CVE-2021-25089

UpdraftPlus < 1.16.69 - Reflected Cross-Site Scripting

The UpdraftPlus WordPress Backup Plugin WordPress plugin before 1.16.69 does not sanitise and escape the updraft_restore parameter before outputting it back in the Restore page, leading to a Reflected Cross-Site Scripting

CVSS 3.1 · 6.1 Medium EPSS < 1% KEV · Not listed

Vendors

Updraftplus

Products

Updraftplus

CVE-2021-25088

Google XML Sitemaps < 4.1.3 - Admin+ Stored Cross-Site Scripting

The XML Sitemaps WordPress plugin before 4.1.3 does not sanitise and escape a settings before outputting it in the Debug page, which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)

CVSS 3.1 · 4.8 Medium EPSS < 1% KEV · Not listed

Vendors

Google Xml Sitemaps Project

Products

Google Xml Sitemaps

CVE-2021-25086

Advanced Page Visit Counter < 6.1.2 - Unauthenticated Stored Cross-Site Scripting

The Advanced Page Visit Counter WordPress plugin before 6.1.2 does not sanitise and escape some input before outputting it in an admin dashboard page, allowing unauthenticated attackers to perform Cross-Site Scripting attacks against admins viewing it

CVSS 3.1 · 6.1 Medium EPSS 1.3% KEV · Not listed

Vendors

Advanced Page Visit Counter Project

Products

Advanced Page Visit Counter

CVE-2021-25085

WOOF - Products Filter for WooCommerce < 1.2.6.3 - Reflected Cross-Site Scripting

The WOOF WordPress plugin before 1.2.6.3 does not sanitise and escape the woof_redraw_elements before outputing back in an admin page, leading to a Reflected Cross-Site Scripting

CVSS 3.1 · 6.1 Medium EPSS 1.7% KEV · Not listed

Vendors

Pluginus

Products

Woocommerce Products Filter

CVE-2021-25084

Advanced Cron Manager - Subscriber+ Arbitrary Events/Schedules Creation/Deletion

The Advanced Cron Manager WordPress plugin before 2.4.2 and Advanced Cron Manager Pro WordPress plugin before 2.5.3 do not have authorisation checks in some of their AJAX actions, allowing any authenticated users, such as subscriber to call them and add or remove events as well as schedules for example

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed

Vendors

Bracketspace

Products

Advanced Cron Manager

CVE-2021-25083

Registrations for the Events Calendar < 2.7.10 - Reflected Cross-Site Scripting

The Registrations for the Events Calendar WordPress plugin before 2.7.10 does not escape the qtype parameter before outputting it back in an attribute in the settings page, leading to a Reflected Cross-Site Scripting

CVSS 3.1 · 6.1 Medium EPSS < 1% KEV · Not listed

Vendors

Roundupwp

Products

Registrations For The Events Calendar

CVE-2021-25082

Popup Builder < 4.0.7 - LFI to RCE

The Popup Builder WordPress plugin before 4.0.7 does not validate and sanitise the sgpb_type parameter before using it in a require statement, leading to a Local File Inclusion issue. Furthermore, since the beginning of the string can be controlled, the issue can lead to RCE vulnerability via wrappers such as PHAR

CVSS 3.1 · 8.8 High EPSS 5.2% KEV · Not listed

Vendors

Sygnoos

Products

Popup Builder

CVE-2021-25081

WP Google Map < 1.8.4 - Arbitrary Post Deletion and Plugin's Settings Update via CSRF

The Maps Plugin using Google Maps for WordPress plugin before 1.8.4 does not have CSRF checks in most of its AJAX actions, which could allow attackers to make logged in admins delete arbitrary posts and update the plugin's settings via a CSRF attack

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Wpgooglemap

Products

Wp Google Map

CVE-2021-25080

Contact Form Entries < 1.1.7 - Unauthenticated Stored Cross-Site Scripting

The Contact Form Entries WordPress plugin before 1.1.7 does not validate, sanitise and escape the IP address retrieved via headers such as CLIENT-IP and X-FORWARDED-FOR, allowing unauthenticated attackers to perform Cross-Site Scripting attacks against logged in admins viewing the created entry

CVSS 3.1 · 6.1 Medium EPSS 84.2% KEV · Not listed

Vendors

Crmperks

Products

Contact Form Entries

CVE-2021-25079

Contact Form Entries < 1.2.4 - Reflected Cross-Site Scripting

The Contact Form Entries WordPress plugin before 1.2.4 does not sanitise and escape various parameters, such as form_id, status, end_date, order, orderby and search before outputting them back in the admin page

CVSS 3.1 · 6.1 Medium EPSS 6.8% KEV · Not listed

Vendors

Crmperks

Products

Contact Form Entries

CVE-2021-25078

Affiliates Manager < 2.9.0 - Unauthenticated Stored Cross-Site Scripting

The Affiliates Manager WordPress plugin before 2.9.0 does not validate, sanitise and escape the IP address of requests logged by the click tracking feature, allowing unauthenticated attackers to perform Cross-Site Scripting attacks against admin viewing the tracked requests.

CVSS 3.1 · 6.1 Medium EPSS 2.3% KEV · Not listed

Vendors

Wpaffiliatemanager

Products

Affiliates Manager

CVE-2021-25077

Store Toolkit for WooCommerce < 2.3.2 - Reflected Cross-Site Scripting

The Store Toolkit for WooCommerce WordPress plugin before 2.3.2 does not sanitise and escape the tab parameter before outputting it back in an admin page in an error message, leading to a Reflected Cross-Site Scripting

CVSS 3.1 · 6.1 Medium EPSS < 1% KEV · Not listed

Vendors

Visser

Products

Store Toolkit For Woocommerce

CVE-2021-25076

WP User Frontend < 3.5.26 - SQL Injection to Reflected Cross-Site Scripting

The WP User Frontend WordPress plugin before 3.5.26 does not validate and escape the status parameter before using it in a SQL statement in the Subscribers dashboard, leading to an SQL injection. Due to the lack of sanitisation and escaping, this could also lead to Reflected Cross-Site Scripting

CVSS 3.1 · 8.8 High EPSS 17.3% KEV · Not listed

Vendors

Wedevs

Products

Wp User Frontend

CVE-2021-25075

Duplicate Page or Post < 1.5.1 - Arbitrary Settings Update to Stored XSS

The Duplicate Page or Post WordPress plugin before 1.5.1 does not have any authorisation and has a flawed CSRF check in the wpdevart_duplicate_post_parametrs_save_in_db AJAX action, allowing any authenticated users, such as subscriber to call it and change the plugin's settings, or perform such attack via CSRF. Furthermore, due to the lack of escaping, this could lead to Stored Cross-Site Scripting issues

CVSS 3.1 · 3.5 Low EPSS 1.4% KEV · Not listed

Vendors

Wpdevart

Products

Duplicate Page Or Post

CVE-2021-25074

WebP Converter for Media < 4.0.3 - Unauthenticated Open redirect

The WebP Converter for Media WordPress plugin before 4.0.3 contains a file (passthru.php) which does not validate the src parameter before redirecting the user to it, leading to an Open Redirect issue

CVSS 3.1 · 6.1 Medium EPSS 2.2% KEV · Not listed

Vendors

Webp Converter For Media Project

Products

Webp Converter For Media

CVE-2021-25073

WP125 < 1.5.5 - Arbitrary Ad Deletion via CSRF

The WP125 WordPress plugin before 1.5.5 does not have CSRF checks in various action, for example when deleting an ad, allowing attackers to make a logged in admin delete them via a CSRF attack

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

Webmaster-source

Products

Wp125