Search vulnerabilities

Expected end of text, found '/' (at char 27), (line:1, col:28)
Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 425,805

CVE-2021-25072

NextScripts: Social Networks Auto-Poster < 4.3.25 - Arbitrary Post Deletion via CSRF

The NextScripts: Social Networks Auto-Poster WordPress plugin before 4.3.25 does not have CSRF check in place when deleting items, allowing attacker to make a logged in admin delete arbitrary posts via a CSRF attack

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Nextscripts
Products
Social Networks Auto Poster
CVE-2021-25071

Akismet Privacy Policies <= 2.0.1 - Reflected Cross-Site Scripting

The WordPress plugin through 2.0.1 does not sanitise and escape the translation parameter before outputting it back in an admin page, leading to a Reflected Cross-Site Scripting

CVSS 3.1 · 6.1 Medium EPSS < 1% KEV · Not listed
Vendors
Inpsyde
Products
Akismet Privacy Policies
CVE-2021-25070

WP Block and Stop Bad Bots < 6.88 - Unauthenticated SQLi

The Block Bad Bots WordPress plugin before 6.88 does not properly sanitise and escape the User Agent before using it in a SQL statement to record logs, leading to an SQL Injection issue

CVSS 3.1 · 9.8 Critical EPSS 1.6% KEV · Not listed
Vendors
Stopbadbots
Products
Block And Stop Bad Bots
CVE-2021-25068

Sync WooCommerce Product feed to Google Shopping <= 1.2.4 - Admin+ SQLi

The Sync WooCommerce Product feed to Google Shopping WordPress plugin through 1.2.4 uses the 'feed_id' POST parameter which is not properly sanitized for use in a SQL statement, leading to a SQL injection vulnerability in the admin dashboard

CVSS 3.1 · 7.2 High EPSS 1.3% KEV · Not listed
Vendors
Dpl
Products
Sync Woocommerce Product Feed To Google Shopping
CVE-2021-25067

Landing Page Builder < 1.4.9.6 - Authenticated Reflected Cross-Site Scripting (XSS)

The Landing Page Builder WordPress plugin before 1.4.9.6 was affected by a reflected XSS in page-builder-add on the ulpb_post admin page.

CVSS 3.1 · 5.4 Medium EPSS 1.1% KEV · Not listed
Vendors
Pluginops
Products
Landing Page
CVE-2021-25066

Ninja Forms < 3.6.10 - Admin+ Stored Cross-Site Scripting via Import

The Ninja Forms Contact Form WordPress plugin before 3.6.10 does not sanitize and escape some imported data, allowing high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed.

CVSS 3.1 · 4.8 Medium EPSS < 1% KEV · Not listed
Vendors
Ninjaforms
Products
Ninja Forms
CVE-2021-25065

Smash Balloon Social Post Feed < 4.1.1 - Authenticated Reflected Cross-Site Scripting (XSS)

The Smash Balloon Social Post Feed WordPress plugin before 4.1.1 was affected by a reflected XSS in custom-facebook-feed in cff-top admin page.

CVSS 3.1 · 5.4 Medium EPSS 1.1% KEV · Not listed
Vendors
Smashballoon
Products
Smash Balloon Social Post Feed
CVE-2021-25064

Wow Countdowns <= 3.1.2 - Admin+ SQLi

The Wow Countdowns WordPress plugin through 3.1.2 does not sanitize user input into the 'did' parameter and uses it in a SQL statement, leading to an authenticated SQL Injection.

CVSS 3.1 · 7.2 High EPSS 1.3% KEV · Not listed
Vendors
Wow-company
Products
Wow Countdowns
CVE-2021-25063

Contact Form 7 Skins < 2.5.1 - Reflected Cross-Site Scripting (XSS)

The Skins for Contact Form 7 WordPress plugin before 2.5.1 does not sanitise and escape the tab parameter before outputting it back in an admin page, leading to a Reflected Cross-Site Scripting

CVSS 3.1 · 6.1 Medium EPSS 2.1% KEV · Not listed
Vendors
Cf7skins
Products
Contact Form 7 Skins
CVE-2021-25062

Orders Tracking for WooCommerce < 1.1.10 - Reflected Cross-Site Scripting

The Orders Tracking for WooCommerce WordPress plugin before 1.1.10 does not sanitise and escape the file_url before outputting it back in an admin page, leading to a Reflected Cross-Site Scripting

CVSS 3.1 · 6.1 Medium EPSS < 1% KEV · Not listed
Vendors
Villatheme
Products
Orders Tracking For Woocommerce
CVE-2021-25061

WP Booking System – Booking Calendar < 2.0.15 - Authenticated Reflected Cross-Site Scripting (XSS)

The WP Booking System WordPress plugin before 2.0.15 was affected by a reflected xss in wp-booking-system on the wpbs-calendars admin page.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed
Vendors
Wpbookingsystem
Products
Wp Booking System
CVE-2021-25060

Five Star Business Profile and Schema < 2.1.7 - Subscriber+ Page Creation & Settings Update to Stored XSS

The Five Star Business Profile and Schema WordPress plugin before 2.1.7 does not have any authorisation and CSRF in its bpfwp_welcome_add_contact_page and bpfwp_welcome_set_contact_information AJAX action, allowing any authenticated users, such as subscribers, to call them. Furthermore, due to the lack of sanitisation, it also lead to Stored Cross-Site Scripting issues

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed
Vendors
Fivestarplugins
Products
Five Star Business Profile And Schema
CVE-2021-25058

The Buffer Button <= 1.0 - Authenticated Stored Cross Site Scripting (XSS)

The Buffer Button WordPress plugin through 1.0 was vulnerable to Authenticated Stored Cross Site Scripting (XSS) within the Twitter username to mention text field.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed
Vendors
The Buffer Button Project
Products
The Buffer Button
CVE-2021-25057

Translation Exchange <= 1.0.14 - Authenticated Stored Cross-Site Scripting (XSS)

The Translation Exchange WordPress plugin through 1.0.14 was vulnerable to Authenticated Stored Cross-Site Scripting (XSS) within the Project Key text field found in the plugin's settings.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed
Vendors
Translationexchange
Products
Translation Exchange
CVE-2021-25056

Ninja Forms < 3.6.10 - Admin+ Stored Cross-Site Scripting

The Ninja Forms Contact Form WordPress plugin before 3.6.10 does not sanitise and escape field labels, allowing high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed.

CVSS 3.1 · 4.8 Medium EPSS < 1% KEV · Not listed
Vendors
Ninjaforms
Products
Ninja Forms
CVE-2021-25055

FeedWordPress < 2022.0123 - Reflected Cross-Site Scripting (XSS)

The FeedWordPress plugin before 2022.0123 is affected by a Reflected Cross-Site Scripting (XSS) within the "visibility" parameter.

CVSS 3.1 · 6.1 Medium EPSS 2.0% KEV · Not listed
Vendors
Feedwordpress Project
Products
Feedwordpress
CVE-2021-25054

WPcalc <= 2.1 - Authenticated SQL Injection

The WPcalc WordPress plugin through 2.1 does not sanitize user input into the 'did' parameter and uses it in a SQL statement, leading to an authenticated SQL Injection vulnerability.

CVSS 3.1 · 8.8 High EPSS 1.4% KEV · Not listed
Vendors
Wow-company
Products
Wpcalc
CVE-2021-25053

WP Coder < 2.5.2 - RFI leading to RCE via CSRF

The WP Coder WordPress plugin before 2.5.2 within the wow-company admin menu page allows to include() arbitrary file with PHP extension (as well as with data:// or http:// protocols), thus leading to CSRF RCE.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed
Vendors
Wow-company
Products
Wp Coder
CVE-2021-25052

Button Generator < 2.3.3 - RFI leading to RCE via CSRF

The Button Generator WordPress plugin before 2.3.3 within the wow-company admin menu page allows to include() arbitrary file with PHP extension (as well as with data:// or http:// protocols), thus leading to CSRF RCE.

CVSS 3.1 · 8.8 High EPSS 3.0% KEV · Not listed
Vendors
Wow-company
Products
Button Generator
CVE-2021-25051

Modal Window < 5.2.2 - RFI leading to RCE via CSRF

The Modal Window WordPress plugin before 5.2.2 within the wow-company admin menu page allows to include() arbitrary file with PHP extension (as well as with data:// or http:// protocols), thus leading to CSRF RCE.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed
Vendors
Wow-company
Products
Modal Window