Search vulnerabilities

Expected end of text, found '/' (at char 27), (line:1, col:28)
Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 425,805

CVE-2021-25008

Code Snippets < 2.14.3 - Reflected Cross-Site Scripting

The Code Snippets WordPress plugin before 2.14.3 does not escape the snippets-safe-mode parameter before outputting it back in attributes, leading to a Reflected Cross-Site Scripting issue

CVSS 3.1 · 6.1 Medium EPSS 2.3% KEV · Not listed
Vendors
Codesnippets
Products
Code Snippets
CVE-2021-25005

SEUR Oficial < 1.7.0 - Admin+ Stored Cross-Site Scripting

The SEUR Oficial WordPress plugin before 1.7.0 does not sanitize and escape some of its settings allowing high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed

CVSS 3.1 · 4.8 Medium EPSS < 1% KEV · Not listed
Vendors
Seur Oficial Project
Products
Seur Oficial
CVE-2021-25004

SEUR Oficial < 1.7.2 - Admin+ Arbitrary File Download

The SEUR Oficial WordPress plugin before 1.7.2 creates a PHP file with a random name when installed, even though it is used for support purposes, it allows to download any file from the web server without restriction after knowing the URL and a password than an administrator can see in the plugin settings page.

CVSS 3.1 · 4.9 Medium EPSS 1.2% KEV · Not listed
Vendors
Seur Oficial Project
Products
Seur Oficial
CVE-2021-25003

WPCargo < 6.9.0 - Unauthenticated RCE

The WPCargo Track & Trace WordPress plugin before 6.9.0 contains a file which could allow unauthenticated attackers to write a PHP file anywhere on the web server, leading to RCE

CVSS 3.1 · 9.8 Critical EPSS 56.1% KEV · Not listed
Vendors
Wptaskforce
Products
Wpcargo Track \& Trace
CVE-2021-25002

Tipsacarrier < 1.5.0.5 - Unauthenticated Orders Disclosure

The Tipsacarrier WordPress plugin before 1.5.0.5 does not have any authorisation check in place some functions, which could allow unauthenticated users to access Orders data which could be used to retrieve the client full address, name and phone via tracking URL

CVSS 3.1 · 7.5 High EPSS 1.5% KEV · Not listed
Vendors
Tipsacarrier Project
Products
Tipsacarrier
CVE-2021-25001

Booster for WooCommerce < 5.4.9 - Reflected Cross-Site Scripting in Product XML Feeds Module

The Booster for WooCommerce WordPress plugin before 5.4.9 does not sanitise and escape the wcj_create_products_xml_result parameter before outputting back in the admin dashboard when the Product XML Feeds module is enabled, leading to a Reflected Cross-Site Scripting issue

CVSS 3.1 · 6.1 Medium EPSS < 1% KEV · Not listed
Vendors
Booster
Products
Booster For Woocommerce
CVE-2021-25000

Booster for WooCommerce < 5.4.9 - Reflected Cross-Site Scripting in General Module

The Booster for WooCommerce WordPress plugin before 5.4.9 does not sanitise and escape the wcj_delete_role parameter before outputting back in the admin dashboard when the General module is enabled, leading to a Reflected Cross-Site Scripting issue

CVSS 3.1 · 6.1 Medium EPSS < 1% KEV · Not listed
Vendors
Booster
Products
Booster For Woocommerce
CVE-2021-24999

Booster for Woocommerce < 5.4.9 - Reflected Cross-Site Scripting in PDF Invoicing Module

The Booster for WooCommerce WordPress plugin before 5.4.9 does not sanitise and escape the wcj_notice parameter before outputting it back in the admin dashboard when the Pdf Invoicing module is enabled, leading to a Reflected Cross-Site Scripting

CVSS 3.1 · 6.1 Medium EPSS < 1% KEV · Not listed
Vendors
Booster
Products
Booster For Woocommerce
CVE-2021-24998

Simple JWT Login < 3.3.0 - Insecure Password Creation

The Simple JWT Login WordPress plugin before 3.3.0 can be used to create new WordPress user accounts with a randomly generated password. The password is generated using the str_shuffle PHP function that "does not generate cryptographically secure values, and should not be used for cryptographic purposes" according to PHP's documentation.

CVSS 3.1 · 7.5 High EPSS 1.2% KEV · Not listed
Vendors
Simple Jwt Login Project
Products
Simple Jwt Login
CVE-2021-24997

WP Guppy < 1.3 - Sensitive Information Disclosure

The WP Guppy WordPress plugin before 1.3 does not have any authorisation in some of the REST API endpoints, allowing any user to call them and could lead to sensitive information disclosure, such as usernames and chats between users, as well as be able to send messages as an arbitrary user

CVSS 3.1 · 6.5 Medium EPSS 2.8% KEV · Not listed
Vendors
Wp-guppy
Products
Wp Guppy
CVE-2021-24996

IDPay for Contact Form 7 <= 2.1.2 - Reflected Cross-Site Scripting

The IDPay for Contact Form 7 WordPress plugin through 2.1.2 does not sanitise and escape the idpay_error parameter before outputting it back in the page leading to a Reflected Cross-Site Scripting

CVSS 3.1 · 6.1 Medium EPSS < 1% KEV · Not listed
Vendors
Wki
Products
Idpay For Contact Form 7
CVE-2021-24995

HTML5 Responsive FAQ <= 2.8.5 - Admin+ Stored Cross-Site Scripting

The HTML5 Responsive FAQ WordPress plugin through 2.8.5 does not properly sanitise and escape some of its settings, which could allow a high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html is disallowed

CVSS 3.1 · 4.8 Medium EPSS < 1% KEV · Not listed
Vendors
Html5 Responsive Faq Project
Products
Html5 Responsive Faq
CVE-2021-24994

WPvivid Backup and Migration Plugin < 0.9.69 - Unauthenticated Stored Cross-Site Scripting

The Migration, Backup, Staging WordPress plugin before 0.9.69 does not have authorisation when adding remote storages, and does not sanitise as well as escape a parameter from such unauthenticated requests before outputting it in admin page, leading to a Stored Cross-Site Scripting issue

CVSS 3.1 · 6.1 Medium EPSS 1.2% KEV · Not listed
Vendors
Wpvivid
Products
Migration\, Backup\, Staging
CVE-2021-24993

Ultimate Product Catalog < 5.0.26 - Subscriber+ Arbitrary Product Creation & Settings Update

The Ultimate Product Catalog WordPress plugin before 5.0.26 does not have authorisation and CSRF checks in some AJAX actions, which could allow any authenticated users, such as subscriber to call them and add arbitrary products, or change the plugin's settings for example

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Etoilewebdesign
Products
Ultimate Product Catalog
CVE-2021-24992

Buttonizer - Smart Floating Action Button < 2.5.5 - Admin+ Stored Cross-Site Scripting

The Smart Floating / Sticky Buttons WordPress plugin before 2.5.5 does not sanitise and escape some parameter before outputting them in attributes and page, which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed.

CVSS 3.1 · 4.8 Medium EPSS < 1% KEV · Not listed
Vendors
Buttonizer
Products
Buttonizer
CVE-2021-24991

WooCommerce PDF Invoices & Packing Slips < 2.10.5 - Reflected Cross-Site Scripting

The WooCommerce PDF Invoices & Packing Slips WordPress plugin before 2.10.5 does not escape the tab and section parameters before outputting it back in an attribute, leading to a Reflected Cross-Site Scripting in the admin dashboard

CVSS 3.1 · 4.8 Medium EPSS 1.2% KEV · Not listed
Vendors
Wpovernight
Products
Woocommerce Pdf Invoices\& Packing Slips
CVE-2021-24989

Accept Donations with PayPal < 1.3.4 - Arbitrary Post Deletion via CSRF

The Accept Donations with PayPal WordPress plugin before 1.3.4 does not have CSRF check in place and does not ensure that the post to be deleted belongs to the plugin, allowing attackers to make a logged in admin delete arbitrary posts from the blog

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Wpplugin
Products
Accept Donations With Paypal
CVE-2021-24988

WP RSS Aggregator < 4.19.3 - Subscriber+ Stored Cross-Site Scripting

The WP RSS Aggregator WordPress plugin before 4.19.3 does not sanitise and escape data before outputting it in the System Info admin dashboard, which could lead to a Stored XSS issue due to the wprss_dismiss_addon_notice AJAX action missing authorisation and CSRF checks, allowing any authenticated users, such as subscriber to call it and set a malicious payload in the addon parameter.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed
Vendors
Wprssaggregator
Products
Wp Rss Aggregator