CVE-2021-24812

BetterLinks < 1.2.6 - Admin+ Stored Cross-Site Scripting

The BetterLinks WordPress plugin before 1.2.6 does not sanitise and escape some of imported link fields, which could lead to Stored Cross-Site Scripting issues when an admin import a malicious CSV.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed

Vendors

Wpdeveloper

Products

Betterlinks

CVE-2021-24811

Shop Page WP < 1.2.8 - Admin+ Stored Cross-Site Scripting

The Shop Page WP WordPress plugin before 1.2.8 does not sanitise and escape some of the Product fields, allowing high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed.

CVSS 3.1 · 4.8 Medium EPSS < 1% KEV · Not listed

Vendors

Shoppagewp

Products

Shop Page Wp

CVE-2021-24810

WP Event Manager < 3.1.23 - Admin+ Stored Cross-Site Scripting

The WP Event Manager WordPress plugin before 3.1.23 does not escape some of its Field Editor settings when outputting them, allowing high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed

CVSS 3.1 · 4.8 Medium EPSS < 1% KEV · Not listed

Vendors

Wp-eventmanager

Products

Wp Event Manager

CVE-2021-24809

BP Better Messages < 1.9.9.41 - Multiple CSRF

The BP Better Messages WordPress plugin before 1.9.9.41 does not check for CSRF in multiple of its AJAX actions: bp_better_messages_leave_chat, bp_better_messages_join_chat, bp_messages_leave_thread, bp_messages_mute_thread, bp_messages_unmute_thread, bp_better_messages_add_user_to_thread, bp_better_messages_exclude_user_from_thread. This could allow attackers to make logged in users do unwanted actions

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

Wordplus

Products

Better Messages

CVE-2021-24808

BP Better Messages < 1.9.9.41 - Reflected Cross-Site Scripting

The BP Better Messages WordPress plugin before 1.9.9.41 sanitise (with sanitize_text_field) but does not escape the 'subject' parameter before outputting it back in an attribute, leading to a Reflected Cross-Site Scripting issue

CVSS 3.1 · 6.1 Medium EPSS < 1% KEV · Not listed

Vendors

Wordplus

Products

Better Messages

CVE-2021-24807

Support Board < 3.3.5 - Agent+ Stored Cross-Site Scripting

The Support Board WordPress plugin before 3.3.5 allows Authenticated (Agent+) users to perform Cross-Site Scripting attacks by placing a payload in the notes field, when an administrator or any authenticated user go to the chat the XSS will be automatically executed.

CVSS 3.1 · 5.4 Medium EPSS 1.4% KEV · Not listed

Vendors

Schiocco

Products

Support Board

CVE-2021-24806

wpDiscuz < 7.3.4 - Arbitrary Comment Addition/Edition/Deletion via CSRF

The wpDiscuz WordPress plugin before 7.3.4 does check for CSRF when adding, editing and deleting comments, which could allow attacker to make logged in users such as admin edit and delete arbitrary comment, or the user who made the comment to edit it via a CSRF attack. Attackers could also make logged in users post arbitrary comment.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed

Vendors

Gvectors

Products

Wpdiscuz

CVE-2021-24805

DW Question & Answer Pro <= 1.3.4 - Multiple CSRF

The DW Question & Answer Pro WordPress plugin through 1.3.4 does not properly check for CSRF in some of its functions, allowing attackers to make logged in users perform unwanted actions, such as update a comment or a question status.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed

Vendors

Designwall

Products

Dw Question \& Answer

CVE-2021-24804

Simple JWT Login < 3.2.1 - Arbitrary Settings Update to Site Takeover via CSRF

The Simple JWT Login WordPress plugin before 3.2.1 does not have nonce checks when saving its settings, allowing attackers to make a logged in admin changed them. Settings such as HMAC verification secret, account registering and default user roles can be updated, which could result in site takeover.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

Simple Jwt Login Project

Products

Simple Jwt Login

CVE-2021-24803

Core Tweaks WP Setup <= 4.1 - Arbitrary Admin Account Creation / Admin Email Update via CSRF

The Core Tweaks WP Setup WordPress plugin through 4.1 allows to bulk-set many settings in WordPress, including the admin email, as well as creating a new admin account. There is no CSRF protection in place, allowing an attacker to arbitrary change the admin email or create another admin account and takeover the website via CSRF attacks

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

Core Tweaks Wp Setup Project

Products

Core Tweaks Wp Setup

CVE-2021-24802

Colorful Categories < 2.0.15 - Arbitrary Colors Update via CSRF

The Colorful Categories WordPress plugin before 2.0.15 does not enforce nonce checks which could allow attackers to make a logged in admin or editor change taxonomy colors via a CSRF attack

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Gesundheit-bewegt

Products

Colorful Categories

CVE-2021-24801

WP Survey Plus <= 1.0 - Subscriber+ AJAX Calls

The WP Survey Plus WordPress plugin through 1.0 does not have any authorisation and CSRF checks in place in its AJAX actions, allowing any user to call them and add/edit/delete Surveys. Furthermore, due to the lack of sanitization in the Surveys' Title, this could also lead to Stored Cross-Site Scripting issues

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed

Vendors

Wp Survey Plus Project

Products

Wp Survey Plus

CVE-2021-24800

DW Question & Answer Pro <= 1.3.4 - Arbitrary Comment Edition via IDOR

The DW Question & Answer Pro WordPress plugin through 1.3.4 does not check that the comment to edit belongs to the user making the request, allowing any user to edit other comments.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed

Vendors

Designwall

Products

Dw Question \& Answer

CVE-2021-24799

Far Future Expiry Header < 1.5 - Plugin's Settings Update via CSRF

The Far Future Expiry Header WordPress plugin before 1.5 does not have CSRF check when saving its settings, which could allow attackers to make a logged in admin change them via a CSRF attack.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed

Vendors

Tipsandtricks-hq

Products

Far Future Expiry Header

CVE-2021-24798

WP Header Images < 2.0.1 - Reflected Cross-Site Scripting

The WP Header Images WordPress plugin before 2.0.1 does not sanitise and escape the t parameter before outputting it back in the plugin's settings page, leading to a Reflected Cross-Site Scripting issue

CVSS 3.1 · 6.1 Medium EPSS < 1% KEV · Not listed

Vendors

Androidbubbles

Products

Wp Header Images

CVE-2021-24797

Tickera < 3.4.8.3 - Unauthenticated Stored Cross-Site Scripting

The Tickera WordPress plugin before 3.4.8.3 does not properly sanitise and escape the Name fields of booked Events before outputting them in the Orders admin dashboard, which could allow unauthenticated users to perform Cross-Site Scripting attacks against admins.

CVSS 3.1 · 6.1 Medium EPSS 1.2% KEV · Not listed

Vendors

Tickera

Products

Tickera

CVE-2021-24796

My Tickets < 1.8.31 - Unauthenticated Stored Cross-Site Scripting

The My Tickets WordPress plugin before 1.8.31 does not properly sanitise and escape the Email field of booked tickets before outputting it in the Payment admin dashboard, which could allow unauthenticated users to perform Cross-Site Scripting attacks against admins

CVSS 3.1 · 6.1 Medium EPSS 1.2% KEV · Not listed

Vendors

My Tickets Project

Products

My Tickets

CVE-2021-24795

Filter Portfolio Gallery <= 1.5 - Arbitrary Gallery Deletion via CSRF

The Filter Portfolio Gallery WordPress plugin through 1.5 is lacking Cross-Site Request Forgery (CSRF) check when deleting a Gallery, which could allow attackers to make a logged in admin delete arbitrary Gallery.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Phoeniixx

Products

Filter Portfolio Gallery

CVE-2021-24794

Connections Business Directory < 10.4.3 - Admin+ Stored Cross-Site Scripting

The Connections Business Directory WordPress plugin before 10.4.3 does not escape the Address settings when creating an Entry, which could allow high privilege users to perform Cross-Site Scripting when the unfiltered_html capability is disallowed.

CVSS 3.1 · 4.8 Medium EPSS < 1% KEV · Not listed

Vendors

Connections-pro

Products

Connections Business Directory

CVE-2021-24793

WPeMatico RSS Feed Fetcher < 2.6.12 - Admin+ Stored Cross-Site Scripting

The WPeMatico RSS Feed Fetcher WordPress plugin before 2.6.12 does not escape the Feed URL added to a campaign before outputting it in an attribute, allowing high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed.

CVSS 3.1 · 4.8 Medium EPSS < 1% KEV · Not listed

Vendors

Etruel

Products

Wpematico Rss Feed Fetcher