Search vulnerabilities

Expected end of text, found '/' (at char 27), (line:1, col:28)
Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 425,803

CVE-2021-24940

Persian Woocommerce <= 5.8.0 - Reflected Cross-Site Scripting

The Persian Woocommerce WordPress plugin through 5.8.0 does not escape the s parameter before outputting it back in an attribute in the admin dashboard, which could lead to a Reflected Cross-Site Scripting issue

CVSS 3.1 · 6.1 Medium EPSS 1.4% KEV · Not listed
Vendors
Woocommerce
Products
Persian-woocommerce
CVE-2021-24939

LoginWP < 3.0.0.5 - Reflected Cross-Site Scripting

The LoginWP (Formerly Peter's Login Redirect) WordPress plugin before 3.0.0.5 does not sanitise and escape the rul_login_url and rul_logout_url parameter before outputting them back in attributes in an admin page, leading to a Reflected Cross-Site Scripting issue

CVSS 3.1 · 6.1 Medium EPSS < 1% KEV · Not listed
Vendors
Profilepress
Products
Loginwp
CVE-2021-24938

WooCommerce Currency Switcher < 1.3.7.1 - Reflected Cross-Site Scripting

The WOOCS WordPress plugin before 1.3.7.1 does not sanitise and escape the key parameter of the woocs_update_profiles_data AJAX action (available to any authenticated user) before outputting it back in the response, leading to a Reflected cross-Site Scripting issue

CVSS 3.1 · 6.1 Medium EPSS < 1% KEV · Not listed
Vendors
Woocommerce
Products
Woocommerce Currency Switcher
CVE-2021-24937

Asset CleanUp < 1.3.8.5 - Reflected Cross-Site Scripting

The Asset CleanUp: Page Speed Booster WordPress plugin before 1.3.8.5 does not escape the wpacu_selected_sub_tab_area parameter before outputting it back in an attribute in an admin page, leading to a Reflected Cross-Site Scripting issue

CVSS 3.1 · 6.1 Medium EPSS < 1% KEV · Not listed
Vendors
Asset Cleanup\
Products
Page Speed Booster Project
CVE-2021-24936

WP Extra File Types < 0.5.1 - CSRF to Stored Cross-Site Scripting

The WP Extra File Types WordPress plugin before 0.5.1 does not have CSRF check when saving its settings, nor sanitise and escape some of them, which could allow attackers to make a logged in admin change them and perform Cross-Site Scripting attacks

CVSS 3.1 · 8.0 High EPSS < 1% KEV · Not listed
Vendors
Wp Extra File Types Project
Products
Wp Extra File Types
CVE-2021-24935

WP Google Fonts < 3.1.5 - Reflected Cross-Site Scripting

The WP Google Fonts WordPress plugin before 3.1.5 does not escape the googlefont_ajax_name and googlefont_ajax_family parameter of the googlefont_action AJAx action (available to any authenticated user) before outputing them in attributes, leading Reflected Cross-Site Scripting issues

CVSS 3.1 · 6.1 Medium EPSS < 1% KEV · Not listed
Vendors
Wp Google Fonts Project
Products
Wp Google Fonts
CVE-2021-24934

Visual CSS Style Editor < 7.5.4 - Reflected Cross-Site Scripting

The Visual CSS Style Editor WordPress plugin before 7.5.4 does not sanitise and escape the wyp_page_type parameter before outputting it back in an admin page, leading to a Reflected Cross-Site Scripting issue

CVSS 3.1 · 6.1 Medium EPSS 1.4% KEV · Not listed
Vendors
Yellowpencil
Products
Visual Css Style Editor
CVE-2021-24933

Dynamic Widgets <= 1.5.16 - Reflected Cross-Site Scripting

The Dynamic Widgets WordPress plugin through 1.5.16 does not escape the prefix parameter before outputting it back in an attribute when using the term_tree AJAX action (available to any authenticated users), leading to a Reflected Cross-Site Scripting issue

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed
Vendors
Bootstrapped
Products
Dynamic Widgets
CVE-2021-24932

Auto Featured Image < 3.9.3 - Reflected Cross-Site Scripting

The Auto Featured Image (Auto Post Thumbnail) WordPress plugin before 3.9.3 does not sanitise and escape the post_id parameter before outputting back in an admin page within a JS block, leading to a Reflected Cross-Site Scripting issue.

CVSS 3.1 · 6.1 Medium EPSS < 1% KEV · Not listed
Vendors
Cm-wp
Products
Auto Featured Image
CVE-2021-24931

Secure Copy Content Protection and Content Locking < 2.8.2 - Unauthenticated SQL Injection

The Secure Copy Content Protection and Content Locking WordPress plugin before 2.8.2 does not escape the sccp_id parameter of the ays_sccp_results_export_file AJAX action (available to both unauthenticated and authenticated users) before using it in a SQL statement, leading to an SQL injection.

CVSS 3.1 · 9.8 Critical EPSS 78.8% KEV · Not listed
Vendors
Ays-pro
Products
Secure Copy Content Protection And Content Locking
CVE-2021-24930

Bookly < 20.3.1 - Staff Member Stored Cross-Site Scripting

The WordPress Online Booking and Scheduling Plugin WordPress plugin before 20.3.1 does not escape the Staff Full Name field before outputting it back in a page, which could lead to a Stored Cross-Site Scripting issue

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed
Vendors
Booking-wp-plugin
Products
Bookly
CVE-2021-24928

Rearrange Woocommerce Products < 3.0.8 - Subscriber+ SQL Injection

The Rearrange Woocommerce Products WordPress plugin before 3.0.8 does not have proper access controls in the save_all_order AJAX action, nor validation and escaping when inserting user data in SQL statement, leading to an SQL injection, and allowing any authenticated user, such as subscriber, to modify arbitrary post content (for example with an XSS payload), as well as exfiltrate any data by copying it to another post.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Rearrange Woocommerce Products Project
Products
Rearrange Woocommerce Products
CVE-2021-24927

My Calendar < 3.2.18 - Subscriber+ Reflected Cross-Site Scripting

The My Calendar WordPress plugin before 3.2.18 does not sanitise and escape the callback parameter of the mc_post_lookup AJAX action (available to any authenticated user) before outputting it back in the response, leading to a Reflected Cross-Site Scripting issue

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed
Vendors
My Calendar Project
Products
My Calendar
CVE-2021-24926

Domain Check < 1.0.17 - Reflected Cross-Site Scripting

The Domain Check WordPress plugin before 1.0.17 does not sanitise and escape the domain parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting issue

CVSS 3.1 · 6.1 Medium EPSS 12.9% KEV · Not listed
Vendors
Domaincheckplugin
Products
Domain Check
CVE-2021-24925

Modern Events Calendar Lite < 6.1.5 - Reflected Cross-Site Scripting

The Modern Events Calendar Lite WordPress plugin before 6.1.5 does not sanitise and escape the current_month_divider parameter of its mec_list_load_more AJAX call (available to both unauthenticated and authenticated users) before outputting it back in the response, leading to a Reflected Cross-Site Scripting issue

CVSS 3.1 · 6.1 Medium EPSS < 1% KEV · Not listed
Vendors
Webnus
Products
Modern Events Calendar Lite
CVE-2021-24924

Email Log < 2.4.8 - Reflected Cross-Site Scripting

The Email Log WordPress plugin before 2.4.8 does not escape the d parameter before outputting it back in an attribute in the Log page, leading to a Reflected Cross-Site Scripting issue

CVSS 3.1 · 6.1 Medium EPSS < 1% KEV · Not listed
Vendors
Email Log Project
Products
Email Log
CVE-2021-24923

Newsletter, SMTP, Email marketing and Subscribe forms by Sendinblue < 3.1.25 - Reflected XSS

The Newsletter, SMTP, Email marketing and Subscribe forms by Sendinblue WordPress plugin before 3.1.25 does not escape the sib-statistics-date parameter before outputting it back in an attribute, leading to a Reflected Cross-Site Scripting issue

CVSS 3.1 · 6.1 Medium EPSS < 1% KEV · Not listed
Vendors
Brevo
Products
Newsletter\, Smtp\, Email Marketing And Subscribe
CVE-2021-24922

Pixel Cat Lite < 2.6.2 - CSRF to Stored Cross-Site Scripting

The Pixel Cat WordPress plugin before 2.6.2 does not have CSRF check when saving its settings, and did not sanitise as well as escape some of them, which could allow attacker to make a logged in admin change them and perform Cross-Site Scripting attacks

CVSS 3.1 · 9.0 Critical EPSS < 1% KEV · Not listed
Vendors
Fatcatapps
Products
Pixel Cat
CVE-2021-24921

Advanced Database Cleaner < 3.0.4 - Reflected Cross-Site Scripting

The Advanced Database Cleaner WordPress plugin before 3.0.4 does not sanitise and escape $_GET keys and values before outputting them back in attributes, leading to Reflected Cross-Site Scripting issues

CVSS 3.1 · 6.1 Medium EPSS < 1% KEV · Not listed
Vendors
Sigmaplugin
Products
Advanced Database Cleaner
CVE-2021-24920

StatCounter < 2.0.7 - Admin+ Stored Cross-Site Scripting

The StatCounter WordPress plugin before 2.0.7 does not sanitise and escape the Project ID and Secure Code settings, which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed

CVSS 3.1 · 4.8 Medium EPSS < 1% KEV · Not listed
Vendors
Statcounter
Products
Statcounter