CVE-2021-25029

Cluevo < 1.8.1 - Admin+ Stored Cross Site Scripting

The CLUEVO LMS, E-Learning Platform WordPress plugin before 1.8.1 does not sanitise and escape Course's module, which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed

CVSS 3.1 · 4.8 Medium EPSS < 1% KEV · Not listed

Vendors

Cluevo

Products

Learning Management System

CVE-2021-25028

Event Tickets < 5.2.2 - Open Redirect

The Event Tickets WordPress plugin before 5.2.2 does not validate the tribe_tickets_redirect_to parameter before redirecting the user to the given value, leading to an arbitrary redirect issue

CVSS 3.1 · 6.1 Medium EPSS 1.9% KEV · Not listed

Vendors

Tri

Products

Event Tickets

CVE-2021-25027

PowerPack Addons for Elementor < 2.6.2 - Reflected Cross-Site Scripting

The PowerPack Addons for Elementor WordPress plugin before 2.6.2 does not escape the tab parameter before outputting it back in an attribute in the admin dashboard, leading to a Reflected Cross-Site Scripting issue

CVSS 3.1 · 6.1 Medium EPSS < 1% KEV · Not listed

Vendors

Ideabox

Products

Powerpack Addons For Elementor

CVE-2021-25026

Patreon WordPress < 1.8.2 - Admin+ Stored Cross-Site Scripting

The Patreon WordPress plugin before 1.8.2 does not sanitise and escape the field "Custom Patreon Page name", which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed

Vendors

Patreon

Products

Patreon Wordpress

CVE-2021-25025

Event Calendar < 1.1.51 - Subscriber+ Event Creation

The EventCalendar WordPress plugin before 1.1.51 does not have proper authorisation and CSRF checks in the add_calendar_event AJAX actions, allowing users with a role as low as subscriber to create events

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed

Vendors

Theeventscalendar

Products

Eventcalendar

CVE-2021-25024

Event Calendar < 1.1.51 - Reflected Cross-Site Scripting

The EventCalendar WordPress plugin before 1.1.51 does not escape some user input before outputting it back in attributes, leading to Reflected Cross-SIte Scripting issues

CVSS 3.1 · 6.1 Medium EPSS < 1% KEV · Not listed

Vendors

Theeventscalendar

Products

Eventcalendar

CVE-2021-25023

Speed Booster Pack < 4.3.3.1 - Admin+ SQL Injection

The Speed Booster Pack ⚡ PageSpeed Optimization Suite WordPress plugin before 4.3.3.1 does not escape the sbp_convert_table_name parameter before using it in a SQL statement to convert the related table, leading to an SQL injection

CVSS 3.1 · 7.2 High EPSS 1.1% KEV · Not listed

Vendors

Optimocha

Products

Speed Booster Pack

CVE-2021-25021

OMGF < 4.5.12 - Admin+ Arbitrary Folder Deletion via Path Traversal

The OMGF | Host Google Fonts Locally WordPress plugin before 4.5.12 does not validate the cache directory setting, allowing high privilege users to use a path traversal vector and delete arbitrary folders when uninstalling the plugin

CVSS 3.1 · 4.9 Medium EPSS 1.1% KEV · Not listed

Vendors

Ffw

Products

Optimize My Google Fonts

CVE-2021-25020

CAOS < 4.1.9 - Admin+ Arbitrary Folder Deletion via Path Traversal

The CAOS | Host Google Analytics Locally WordPress plugin before 4.1.9 does not validate the cache directory setting, allowing high privilege users to use a path traversal vector and delete arbitrary folders when uninstalling the plugin

CVSS 3.1 · 4.9 Medium EPSS 1.1% KEV · Not listed

Vendors

Daan

Products

Complete Analytics Optimization Suite

CVE-2021-25019

SEO Plugin by Squirrly SEO < 11.1.12 - Reflected Cross-Site Scripting

The SEO Plugin by Squirrly SEO WordPress plugin before 11.1.12 does not escape the type parameter before outputting it back in an attribute in an admin page, leading to a Reflected Cross-Site Scripting

CVSS 3.1 · 6.1 Medium EPSS < 1% KEV · Not listed

Vendors

Squirrly

Products

Seo Plugin By Squirrly Seo

CVE-2021-25018

PPOM for WooCommerce < 24.0 - Subscriber+ Settings Update to Stored XSS

The PPOM for WooCommerce WordPress plugin before 24.0 does not have authorisation and CSRF checks in the ppom_settings_panel_action AJAX action, allowing any authenticated to call it and set arbitrary settings. Furthermore, due to the lack of sanitisation and escaping, it could lead to Stored XSS issues

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed

Vendors

Najeebmedia

Products

Ppom For Woocommerce

CVE-2021-25017

Tutor LMS < 1.9.12 - Reflected Cross-Site Scripting

The Tutor LMS WordPress plugin before 1.9.12 does not escape the search parameter before outputting it back in an attribute in an admin page, leading to a Reflected Cross-Site Scripting

CVSS 3.1 · 6.1 Medium EPSS 1.0% KEV · Not listed

Vendors

Themeum

Products

Tutor Lms

CVE-2021-25016

Chaty < 2.8.3 - Reflected Cross-Site Scripting

The Chaty WordPress plugin before 2.8.3 and Chaty Pro WordPress plugin before 2.8.2 do not sanitise and escape the search parameter before outputting it back in the admin dashboard, leading to a Reflected Cross-Site Scripting

CVSS 3.1 · 6.1 Medium EPSS 1.8% KEV · Not listed

Vendors

Premio

Products

Chaty Chaty Pro

CVE-2021-25015

myCred < 2.4 - Reflected Cross-Site Scripting

The myCred WordPress plugin before 2.4 does not sanitise and escape the search query before outputting it back in the history dashboard page, leading to a Reflected Cross-Site Scripting issue

CVSS 3.1 · 6.1 Medium EPSS < 1% KEV · Not listed

Vendors

Mycred

Products

Mycred

CVE-2021-25014

Ibtana < 1.1.4.9 - Subscriber+ Settings Update to Stored XSS

The Ibtana WordPress plugin before 1.1.4.9 does not have authorisation and CSRF checks in the ive_save_general_settings AJAX action, allowing any authenticated users, such as subscriber to call it and change the plugin's settings which could lead to Stored Cross-Site Scripting issue.

CVSS 3.1 · 3.5 Low EPSS < 1% KEV · Not listed

Vendors

Vowelweb

Products

Ibtana

CVE-2021-25013

Qubely < 1.7.8 - Subscriber+ Arbitrary Post Deletion

The Qubely WordPress plugin before 1.7.8 does not have authorisation and CSRF check on the qubely_delete_saved_block AJAX action, and does not ensure that the block to be deleted belong to the plugin, as a result, any authenticated users, such as subscriber can delete arbitrary posts

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Themeum

Products

Qubely

CVE-2021-25012

Pz-LinkCard <= 2.4.4.4 - Reflected Cross-Site Scripting

The Pz-LinkCard WordPress plugin through 2.4.4.4 does not sanitise and escape multiple parameters before outputting them back in admin dashboard pages, leading to Reflected Cross-Site Scripting issues

CVSS 3.1 · 6.1 Medium EPSS < 1% KEV · Not listed

Vendors

Popozure

Products

Pz-linkcard

CVE-2021-25011

WP Google Map < 1.8.1 - Subscriber+ Arbitrary Post Deletion and Plugin's Settings Update

The Maps Plugin using Google Maps for WordPress plugin before 1.8.1 does not have proper authorisation and CSRF in most of its AJAX actions, which could allow any authenticated users, such as subscriber to delete arbitrary posts and update the plugin's settings.

CVSS 3.1 · 5.7 Medium EPSS < 1% KEV · Not listed

Vendors

Wpgooglemap

Products

Wp Google Map

CVE-2021-25010

Post Snippets < 3.1.4 - CSRF to Stored Cross-Site Scripting

The Post Snippets WordPress plugin before 3.1.4 does not have CSRF check when importing files, allowing attacker to make a logged In admin import arbitrary snippets. Furthermore, imported snippers are not sanitised and escaped, which could lead to Stored Cross-Site Scripting issues

CVSS 3.1 · 9.6 Critical EPSS < 1% KEV · Not listed

Vendors

Postsnippets

Products

Post Snippets

CVE-2021-25009

CorreosExpress <= 2.6.0 - Sensitive Information Disclosure

The CorreosExpress WordPress plugin through 2.6.0 generates log files which are publicly accessible, and contain sensitive information such as sender/receiver names, phone numbers, physical and email addresses

CVSS 3.1 · 5.3 Medium EPSS 1.2% KEV · Not listed

Vendors

Correosexpress Project

Products

Correosexpress