CVE-2021-24919

Wicked Folders < 2.18.10 - Subscriber+ SQL Injection

The Wicked Folders WordPress plugin before 2.8.10 does not sanitise and escape the folder_id parameter before using it in a SQL statement in the wicked_folders_save_sort_order AJAX action, available to any authenticated user. leading to an SQL injection

CVSS 3.1 · 8.8 High EPSS 1.5% KEV · Not listed

Vendors

Wickedplugins

Products

Wicked Folders

CVE-2021-24918

Smash Balloon Social Post Feed < 4.0.1 - Subscriber+ Arbitrary Plugin Settings Update to Stored XSS

The Smash Balloon Social Post Feed WordPress plugin before 4.0.1 did not have any privilege or nonce validation before saving the plugin's setting. As a result, any logged-in user on a vulnerable site could update the settings and store rogue JavaScript on each of its posts and pages.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed

Vendors

Smashballoon

Products

Smash Balloon Social Post Feed

CVE-2021-24917

WPS Hide Login < 1.9.1 - Protection Bypass with Referer-Header

The WPS Hide Login WordPress plugin before 1.9.1 has a bug which allows to get the secret login page by setting a random referer string and making a request to /wp-admin/options.php as an unauthenticated user.

CVSS 3.1 · 7.5 High EPSS 72.2% KEV · Not listed

Vendors

Wpserveur

Products

Wps Hide Login

CVE-2021-24916

Qubely < 1.8.6 - Unauthenticated Arbitrary E-mail Sending

The Qubely WordPress plugin before 1.8.6 allows unauthenticated user to send arbitrary e-mails to arbitrary addresses via the qubely_send_form_data AJAX action.

CVSS 3.1 · 7.5 High EPSS 1.7% KEV · Not listed

Vendors

Themeum

Products

Qubely

CVE-2021-24915

Contest Gallery < 13.1.0.6 - Missing Access Controls to Unauthenticated SQL injection / Email Address Disclosure

The Contest Gallery WordPress plugin before 13.1.0.6 does not have capability checks and does not sanitise or escape the cg-search-user-name-original parameter before using it in a SQL statement when exporting users from a gallery, which could allow unauthenticated to perform SQL injections attacks, as well as get the list of all users registered on the blog, including their username and email address

CVSS 3.1 · 9.8 Critical EPSS 12.0% KEV · Not listed

Vendors

Contest Gallery

Products

Contest Gallery

CVE-2021-24914

Tawk.to Live Chat < 0.6.0 - Subscriber+ Visitor Monitoring & Chat Removal

The Tawk.To Live Chat WordPress plugin before 0.6.0 does not have capability and CSRF checks in the tawkto_setwidget and tawkto_removewidget AJAX actions, available to any authenticated user. The first one allows low-privileged users (including simple subscribers) to change the 'tawkto-embed-widget-page-id' and 'tawkto-embed-widget-widget-id' parameters. Any authenticated user can thus link the vulnerable website to their own Tawk.to instance. Consequently, they will be able to monitor the vulnerable website and interact with its visitors (receive contact messages, answer, ...). They will also be able to display an arbitrary Knowledge Base. The second one will remove the live chat widget from pages.

CVSS 3.1 · 8.0 High EPSS < 1% KEV · Not listed

Vendors

Tawk

Products

Tawk.to Live Chat

CVE-2021-24913

Logo Showcase with Slick Slider < 2.0.1 - Arbitrary Media Title/Description/Alt Text/URL Update via CSRF

The Logo Showcase with Slick Slider WordPress plugin before 2.0.1 does not have CSRF check in the lswss_save_attachment_data AJAX action, allowing attackers to make a logged in high privilege user, change title, description, alt text, and URL of arbitrary uploaded media.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed

Vendors

Infornweb

Products

Logo Showcase With Slick Slider

CVE-2021-24912

Transposh WordPress Translation < 1.0.8 - CSRF to Stored XSS

The Transposh WordPress Translation WordPress plugin before 1.0.8 does not have CSRF check in its tp_translation AJAX action, which could allow attackers to make authorised users add a translation. Given the lack of sanitisation in the tk0 parameter, this could lead to a Stored Cross-Site Scripting issue which will be executed in the context of a logged in admin

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed

Vendors

Transposh

Products

Transposh Wordpress Translation

CVE-2021-24911

Transposh WordPress Translation < 1.0.8 - Stored Cross-Site Scripting

The Transposh WordPress Translation WordPress plugin before 1.0.8 does not sanitise and escape the tk0 parameter from the tp_translation AJAX action, leading to Stored Cross-Site Scripting, which will trigger in the admin dashboard of the plugin. The minimum role needed to perform such attack depends on the plugin "Who can translate ?" setting.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed

Vendors

Transposh

Products

Transposh Wordpress Translation

CVE-2021-24910

Transposh WordPress Translation < 1.0.8 - Reflected Cross-Site Scripting

The Transposh WordPress Translation WordPress plugin before 1.0.8 does not sanitise and escape the a parameter via an AJAX action (available to both unauthenticated and authenticated users when the curl library is installed) before outputting it back in the response, leading to a Reflected Cross-Site Scripting issue

CVSS 3.1 · 6.1 Medium EPSS 1.7% KEV · Not listed

Vendors

Transposh

Products

Transposh Wordpress Translation

CVE-2021-24909

ACF Photo Gallery Field < 1.7.5 - Reflected Cross-Site Scripting

The ACF Photo Gallery Field WordPress plugin before 1.7.5 does not sanitise and escape the post parameter in the includes/acf_photo_gallery_metabox_edit.php file before outputing back in an attribute, leading to a Reflected Cross-Site Scripting issue

CVSS 3.1 · 6.1 Medium EPSS < 1% KEV · Not listed

Vendors

Navz

Products

Acf Photo Gallery Field

CVE-2021-24908

Check & Log Email < 1.0.4 - Reflected Cross-Site Scripting

The Check & Log Email WordPress plugin before 1.0.4 does not escape the d parameter before outputting it back in an attribute, leading to a Reflected Cross-Site Scripting

CVSS 3.1 · 6.1 Medium EPSS < 1% KEV · Not listed

Vendors

Wpchill

Products

Check \& Log Email

CVE-2021-24907

Everest Forms < 1.8.0 - Reflected Cross-Site Scripting

The Contact Form, Drag and Drop Form Builder for WordPress plugin before 1.8.0 does not escape the status parameter before outputting it back in an attribute, leading to a Reflected Cross-Site Scripting issue

CVSS 3.1 · 6.1 Medium EPSS < 1% KEV · Not listed

Vendors

Wpeverest

Products

Everest Forms

CVE-2021-24906

Protect WP Admin < 3.6.2 - Unauthenticated Plugin Deactivation

The Protect WP Admin WordPress plugin before 3.6.2 does not check for authorisation in the lib/pwa-deactivate.php file, which could allow unauthenticated users to disable the plugin (and therefore the protection offered) via a crafted request

CVSS 3.1 · 7.5 High EPSS 1.5% KEV · Not listed

Vendors

Wp-experts

Products

Protect Wp Admin

CVE-2021-24905

Advanced Contact form 7 DB < 1.8.7 - Subscriber+ Arbitrary File Deletion

The Advanced Contact form 7 DB WordPress plugin before 1.8.7 does not have authorisation nor CSRF checks in the acf7_db_edit_scr_file_delete AJAX action, and does not validate the file to be deleted, allowing any authenticated user to delete arbitrary files on the web server. For example, removing the wp-config.php allows attackers to trigger WordPress setup again, gain administrator privileges and execute arbitrary code or display arbitrary content to the users.

CVSS 3.1 · 8.0 High EPSS < 1% KEV · Not listed

Vendors

Vsourz

Products

Advanced Cf7 Db

CVE-2021-24904

Mortgage Calculators WP < 1.56 - Admin+ Stored Cross-Site Scripting

The Mortgage Calculators WP WordPress plugin before 1.56 does not implement any sanitisation on the color setting of the background of a calculator, which could allow high privilege users to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed.

CVSS 3.1 · 4.8 Medium EPSS 5.1% KEV · Not listed

Vendors

Lenderd

Products

Mortgage Calculators Wp

CVE-2021-24903

GRAND FlaGallery <= 6.1.2 - Admin+ Stored Cross-Site Scripting

The GRAND FlaGallery WordPress plugin through 6.1.2 does not sanitise and escape some of its gallery settings, which could allow high privilege users to perform Cross-Site scripting attacks even when the unfiltered_html capability is disallowed.

CVSS 3.1 · 4.8 Medium EPSS < 1% KEV · Not listed

Vendors

Codeasily

Products

Grand Flagallery

CVE-2021-24902

Typebot < 1.4.3 - Admin+ Stored Cross Site Scripting

The Typebot | Build beautiful conversational forms WordPress plugin before 1.4.3 does not sanitise and escape the Publish ID setting, which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed.

CVSS 3.1 · 4.8 Medium EPSS < 1% KEV · Not listed

Vendors

Typebot

Products

Typebot

CVE-2021-24901

Security Audit <= 1.0.0 - Admin+ Stored Cross Site Scripting

The Security Audit WordPress plugin through 1.0.0 does not sanitise and escape the Data Id setting, which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed.

CVSS 3.1 · 4.8 Medium EPSS 5.1% KEV · Not listed

Vendors

Securemoz

Products

Security Audit

CVE-2021-24900

Ninja Tables < 4.1.8 - Admin+ Stored Cross-Site Cross-Site Scripting

The Ninja Tables WordPress plugin before 4.1.8 does not sanitise and escape some of its table fields, which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed

CVSS 3.1 · 4.8 Medium EPSS < 1% KEV · Not listed

Vendors

Wpmanageninja

Products

Ninja Tables