CVE-2021-25050

Remove Footer Credit < 1.0.11 - Admin+ Stored Cross-Site Scripting

The Remove Footer Credit WordPress plugin before 1.0.11 does properly sanitise its settings, allowing high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html is disallowed.

CVSS 3.1 · 4.8 Medium EPSS < 1% KEV · Not listed

Vendors

Wpchill

Products

Remove Footer Credit

CVE-2021-25049

Mobile Events Manager < 1.4.4 - Admin+ Stored Cross-Site Scripting

The Mobile Events Manager WordPress plugin before 1.4.4 does not sanitise and escape various of its settings, allowing high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed

CVSS 3.1 · 4.8 Medium EPSS < 1% KEV · Not listed

Vendors

Mobileeventsmanager

Products

Mobile Events Manager

CVE-2021-25048

KingComposer <= 2.9.6 - Subscriber+ Stored Cross-Site Scripting

The KingComposer WordPress plugin through 2.9.6 does not have authorisation, CSRF and sanitisation/escaping when creating profile, allowing any authenticated users to create arbitrary ones, with Cross-Site Scripting payloads in them

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed

Vendors

King-theme

Products

Kingcomposer

CVE-2021-25047

10Web Social Photo Feed < 1.4.29 - Reflected Cross-Site Scripting (XSS)

The 10Web Social Photo Feed WordPress plugin before 1.4.29 was affected by a reflected Cross-Site Scripting (XSS) vulnerability in the wdi_apply_changes admin page, allowing an attacker to perform such attack against any logged in users

CVSS 3.1 · 6.1 Medium EPSS < 1% KEV · Not listed

Vendors

10web

Products

10websocial

CVE-2021-25046

Modern Events Calendar Lite < 6.2.0 - Subscriber+ Category Add Leading to Stored XSS

The Modern Events Calendar Lite WordPress plugin before 6.2.0 alloed any logged-in user, even a subscriber user, may add a category whose parameters are incorrectly escaped in the admin panel, leading to stored XSS.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed

Vendors

Webnus

Products

Modern Events Calendar Lite

CVE-2021-25045

Asgaros Forum < 1.15.15 - Admin+ SQL Injection via forum_id

The Asgaros Forum WordPress plugin before 1.15.15 does not validate or escape the forum_id parameter before using it in a SQL statement when editing a forum, leading to an SQL injection issue

CVSS 3.1 · 7.2 High EPSS 1.5% KEV · Not listed

Vendors

Asgaros

Products

Asgaros Forum

CVE-2021-25044

Cryptocurrency Pricing list and Ticker <= 1.5 - Reflected Cross-Site Scripting

The Cryptocurrency Pricing list and Ticker WordPress plugin through 1.5 does not sanitise and escape the ccpw_setpage parameter before outputting it back in pages where its shortcode is embed, leading to a Reflected Cross-Site Scripting issue

CVSS 3.1 · 6.1 Medium EPSS < 1% KEV · Not listed

Vendors

Premium-themes

Products

Cryptocurrency Pricing List And Ticker

CVE-2021-25043

WOOCS < 1.3.7.3 - Reflected Cross-Site Scripting

The WOOCS WordPress plugin before 1.3.7.3 does not sanitise and escape the custom_prices parameter before outputting it back in the response, leading to a Reflected Cross-Site Scripting issue

CVSS 3.1 · 6.1 Medium EPSS < 1% KEV · Not listed

Vendors

Pluginus

Products

Woocommerce Currency Switcher

CVE-2021-25041

Photo Gallery by 10Web < 1.5.68 - Reflected Cross-Site Scripting (XSS)

The Photo Gallery by 10Web WordPress plugin before 1.5.68 is vulnerable to Reflected Cross-Site Scripting (XSS) issues via the bwg_album_breadcrumb_0 and shortcode_id GET parameters passed to the bwg_frontend_data AJAX action

CVSS 3.1 · 6.1 Medium EPSS < 1% KEV · Not listed

Vendors

10web

Products

Photo Gallery

CVE-2021-25040

Booking Calendar < 8.9.2 - Reflected Cross-Site Scripting

The Booking Calendar WordPress plugin before 8.9.2 does not sanitise and escape the booking_type parameter before outputting it back in an admin page, leading to a Reflected Cross-Site Scripting

CVSS 3.1 · 6.1 Medium EPSS < 1% KEV · Not listed

Vendors

Booking Calendar Project

Products

Booking Calendar

CVE-2021-25039

Multisite Content Copier/Updater < 2.1.0 - Reflected Cross-Site Scripting

The WordPress Multisite Content Copier/Updater WordPress plugin before 2.1.0 does not sanitise and escape the wmcc_content_type, wmcc_source_blog and wmcc_record_per_page parameters before outputting them back in attributes, leading to Reflected Cross-Site Scripting issues

CVSS 3.1 · 6.1 Medium EPSS < 1% KEV · Not listed

Vendors

Obtaininfotech

Products

Multisite Content Copier\/updater

CVE-2021-25038

Multisite User Sync/Unsync < 2.1.2 - Reflected Cross-Site Scripting

The WordPress Multisite User Sync/Unsync WordPress plugin before 2.1.2 does not sanitise and escape the wmus_source_blog and wmus_record_per_page parameters before outputting them back in attributes, leading to Reflected Cross-Site Scripting issues

CVSS 3.1 · 6.1 Medium EPSS < 1% KEV · Not listed

Vendors

Obtaininfotech

Products

Multisite User Sync\/unsync

CVE-2021-25037

All In One SEO < 4.1.5.3 - Authenticated SQL Injection

The All in One SEO WordPress plugin before 4.1.5.3 is affected by an authenticated SQL injection issue, which was discovered during an internal audit by the Jetpack Scan team, and could grant attackers access to privileged information from the affected site’s database (e.g., usernames and hashed passwords).

CVSS 3.1 · 6.5 Medium EPSS 1.3% KEV · Not listed

Vendors

Aioseo

Products

All In One Seo

CVE-2021-25036

All In One SEO < 4.1.5.3 - Authenticated Privilege Escalation

The All in One SEO WordPress plugin before 4.1.5.3 is affected by a Privilege Escalation issue, which was discovered during an internal audit by the Jetpack Scan team, and may grant bad actors access to protected REST API endpoints they shouldn’t have access to. This could ultimately enable users with low-privileged accounts, like subscribers, to perform remote code execution on affected sites.

CVSS 3.1 · 8.8 High EPSS 3.1% KEV · Not listed

Vendors

Aioseo

Products

All In One Seo

CVE-2021-25035

Backup and Staging by WP Time Capsule < 1.22.7 - Reflected Cross-Site Scripting

The Backup and Staging by WP Time Capsule WordPress plugin before 1.22.7 does not sanitise and escape the error parameter before outputting it back in an admin page, leading to a Reflected Cross-Site Scripting

CVSS 3.1 · 6.1 Medium EPSS < 1% KEV · Not listed

Vendors

Revmakx

Products

Backup And Staging By Wp Time Capsule

CVE-2021-25034

WP User < 7.0 - Reflected Cross-Site Scripting

The WP User WordPress plugin before 7.0 does not sanitise and escape some parameters in pages where the [wp_user] shortcode is used, leading to Reflected Cross-Site Scripting issues

CVSS 3.1 · 6.1 Medium EPSS < 1% KEV · Not listed

Vendors

Wp User Project

Products

Wp User

CVE-2021-25033

Noptin < 1.6.5 - Open Redirect

The WordPress Newsletter Plugin WordPress plugin before 1.6.5 does not validate the to parameter before redirecting the user to its given value, leading to an open redirect issue

CVSS 3.1 · 6.1 Medium EPSS 2.3% KEV · Not listed

Vendors

Noptin

Products

Noptin

CVE-2021-25032

PublishPress Capabilities < 2.3.1 - Unauthenticated Arbitrary Options Update to Blog Compromise

The PublishPress Capabilities WordPress plugin before 2.3.1, PublishPress Capabilities Pro WordPress plugin before 2.3.1 does not have authorisation and CSRF checks when updating the plugin's settings via the init hook, and does not ensure that the options to be updated belong to the plugin. As a result, unauthenticated attackers could update arbitrary blog options, such as the default role and make any new registered user with an administrator role.

CVSS 3.1 · 9.8 Critical EPSS 7.1% KEV · Not listed

Vendors

Publishpress

Products

Capabilities

CVE-2021-25031

Image Hover Effects Ultimate < 9.7.1 - Reflected Cross-Site Scripting

The Image Hover Effects Ultimate (Image Gallery, Effects, Lightbox, Comparison or Magnifier) WordPress plugin before 9.7.1 does not escape the effects parameter before outputting it back in an attribute in an admin page, leading to a Reflected Cross-Site Scripting

CVSS 3.1 · 6.1 Medium EPSS < 1% KEV · Not listed

Vendors

Oxilab

Products

Image Hover Effects Ultimate

CVE-2021-25030

Events Made Easy < 2.2.36 - Subscriber+ SQL Injection

The Events Made Easy WordPress plugin before 2.2.36 does not sanitise and escape the search_text parameter before using it in a SQL statement via the eme_searchmail AJAX action, available to any authenticated users. As a result, users with a role as low as subscriber can call it and perform SQL injection attacks

CVSS 3.1 · 8.8 High EPSS 1.4% KEV · Not listed

Vendors

E-dynamics

Products

Events Made Easy