Search vulnerabilities

Expected end of text, found '/' (at char 27), (line:1, col:28)
Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 425,803

CVE-2021-24622

WP Ticket < 5.10.4 - Admin+ Stored Cross-Site Scripting

The Customer Service Software & Support Ticket System WordPress plugin before 5.10.4 does not sanitize or escape form fields before outputting it in the List, which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed.

CVSS 3.1 · 4.8 Medium EPSS < 1% KEV · Not listed
Vendors
Emarketdesign
Products
Customer Service Software \& Support Ticket System
CVE-2021-24621

WP Courses LMS < 2.0.44 - Authenticated Stored XSS via Video Embed Code

The WP Courses LMS WordPress plugin before 2.0.44 does not sanitise its Video Embed Code, allowing malicious code to be injected in it by high privilege users, even when the unfiltered_html capability is disallowed, which could lead to Stored Cross-Site Scripting issues

CVSS 3.1 · 4.8 Medium EPSS < 1% KEV · Not listed
Vendors
Stratospheredigital
Products
Wp Courses Lms
CVE-2021-24620

Simple eCommerce <= 2.2.5 - Arbitrary File Upload

The WordPress Simple Ecommerce Shopping Cart Plugin- Sell products through Paypal plugin through 2.2.5 does not check for the uploaded Downloadable Digital product file, allowing any file, such as PHP to be uploaded by an administrator. Furthermore, as there is no CSRF in place, attackers could also make a logged admin upload a malicious PHP file, which would lead to RCE

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed
Vendors
Simple-e-commerce-shopping-cart Project
Products
Simple-e-commerce-shopping-cart
CVE-2021-24619

Per Page Add to Head <= 1.4.4 - Authenticated Stored XSS

The Per page add to head WordPress plugin through 1.4.4 does not properly sanitise one of its setting, allowing malicious HTML to be inserted by high privilege users even when the unfiltered_html capability is disallowed, which could lead to Cross-Site Scripting issues.

CVSS 3.1 · 4.8 Medium EPSS < 1% KEV · Not listed
Vendors
Evona
Products
Per Page Add To Head
CVE-2021-24618

Donate With QRCode < 1.4.5 - Stored Cross-Site Scripting

The Donate With QRCode WordPress plugin before 1.4.5 does not sanitise or escape its QRCode Image setting, which result into a Stored Cross-Site Scripting (XSS). Furthermore, the plugin also does not have any CSRF and capability checks in place when saving such setting, allowing any authenticated user (as low as subscriber), or unauthenticated user via a CSRF vector to update them and perform such attack.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed
Vendors
Wbolt
Products
Donate With Qrcode
CVE-2021-24617

GamePress <= 1.1.0 - Reflected Cross-Site Scripting

The GamePress WordPress plugin through 1.1.0 does not escape the op_edit POST parameter before outputting it back in multiple Game Option pages, leading to Reflected Cross-Site Scripting issues

CVSS 3.1 · 6.1 Medium EPSS < 1% KEV · Not listed
Vendors
Gamepress Project
Products
Gamepress
CVE-2021-24616

AddToAny Share Buttons < 1.7.48 - Admin+ Stored Cross-Site Scripting

The AddToAny Share Buttons WordPress plugin before 1.7.48 does not escape its Image URL button setting, which could lead allow high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed.

CVSS 3.1 · 4.8 Medium EPSS < 1% KEV · Not listed
Vendors
Addtoany
Products
Addtoany Share Buttons
CVE-2021-24615

Wechat Reward <= 1.7 - CSRF to Stored Cross-Site Scripting

The Wechat Reward WordPress plugin through 1.7 does not sanitise or escape its QR settings, nor has any CSRF check in place, allowing attackers to make a logged in admin change the settings and perform Cross-Site Scripting attacks.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed
Vendors
Wechat Reward Project
Products
Wechat Reward
CVE-2021-24614

Book appointment Online < 1.39 - Authenticated Stored Cross-Site Scripting (XSS)

The Book appointment online WordPress plugin before 1.39 does not sanitise or escape Service Prices before outputting it in the List, which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed.

CVSS 3.1 · 4.8 Medium EPSS < 1% KEV · Not listed
Vendors
Oz-plugin
Products
Book Appointment Online
CVE-2021-24613

Post Views Counter < 1.3.5 - Authenticated Stored XSS

The Post Views Counter WordPress plugin before 1.3.5 does not sanitise or escape its Post Views Label settings, which could allow high privilege users to perform Cross-Site Scripting attacks in the frontend even when the unfiltered_html capability is disallowed

CVSS 3.1 · 4.8 Medium EPSS < 1% KEV · Not listed
Vendors
Dfactory
Products
Post Views Counter
CVE-2021-24612

Sociable <= 4.3.4.1 - Admin+ Stored Cross-Site Scripting

The Sociable WordPress plugin through 4.3.4.1 does not sanitise or escape some of its settings before outputting them in the admins dashboard, allowing high privilege users to perform Cross-Site Scripting attacks against other users even when the unfiltered_html capability is disallowed

CVSS 3.1 · 4.8 Medium EPSS < 1% KEV · Not listed
Vendors
Sociable Project
Products
Sociable
CVE-2021-24611

Keywords & Meta <= 3.0 - CSRF to Stored Cross-Site Scripting (XSS)

The Keyword Meta WordPress plugin through 3.0 does not sanitise of escape its settings before outputting them back in the page after they are saved, allowing for Cross-Site Scripting issues. Furthermore, it is also lacking any CSRF check, allowing attacker to make a logged in high privilege user save arbitrary setting via a CSRF attack.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed
Vendors
Keyword Meta Project
Products
Keyword Meta
CVE-2021-24610

TranslatePress < 2.0.9 - Authenticated Stored Cross-Site Scripting

The TranslatePress WordPress plugin before 2.0.9 does not implement a proper sanitisation on the translated strings. The 'trp_sanitize_string' function only removes script tag with a regex, still allowing other HTML tags and attributes to execute javascript, which could lead to authenticated Stored Cross-Site Scripting issues.

CVSS 3.1 · 4.8 Medium EPSS 5.4% KEV · Not listed
Vendors
Cozmoslabs
Products
Translatepress
CVE-2021-24609

WP Mapa Politico Espana < 3.7.0- Authenticated Stored XSS

The WP Mapa Politico Espana WordPress plugin before 3.7.0 does not sanitise or escape some of its settings before outputting them in attributes, allowing high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html is disallowed

CVSS 3.1 · 4.8 Medium EPSS < 1% KEV · Not listed
Vendors
Wp Mapa Politico Espana Project
Products
Wp Mapa Politico Espana
CVE-2021-24608

Formidable Form Builder < 5.0.07 - Admin+ Stored Cross-Site Scripting

The Formidable Form Builder – Contact Form, Survey & Quiz Forms Plugin for WordPress plugin before 5.0.07 does not sanitise and escape its Form's Labels, allowing high privileged users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed

CVSS 3.1 · 4.8 Medium EPSS < 1% KEV · Not listed
Vendors
Strategy11
Products
Formidable Form Builder
CVE-2021-24607

Storefront Footer Text <= 1.0.1 - Admin+ Stored Cross-Site Scripting

The Storefront Footer Text WordPress plugin through 1.0.1 does not sanitize and escape the "Footer Credit Text" added to pages, allowing high privilege users to perform Cross-Site Scripting attacks even when the unfiltered-html capability is disallowed.

CVSS 3.1 · 4.8 Medium EPSS < 1% KEV · Not listed
Vendors
Wooassist
Products
Storefront Footer Text
CVE-2021-24606

Availability Calendar < 1.2.1 - Authenticated SQL Injection

The Availability Calendar WordPress plugin before 1.2.1 does not escape the category attribute from its shortcode before using it in a SQL statement, leading to a SQL Injection issue, which can be exploited by any user able to add shortcode to posts/pages, such as contributor+

CVSS 3.1 · 8.8 High EPSS 1.3% KEV · Not listed
Vendors
Offshorewebmaster
Products
Availability Calendar
CVE-2021-24605

Custom Post View Generator <= 0.4.6 - Reflected Cross-Site Scripting

The create_post_page AJAX action of the Custom Post View Generator WordPress plugin through 0.4.6 (available to authenticated user) does not sanitise or escape user input before outputting it back in the response, leading to a Reflected Cross-Site issue

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed
Vendors
Custom Post View Generator Project
Products
Custom Post View Generator
CVE-2021-24604

Availability Calendar < 1.2.2 - Authenticated Stored Cross-Site Scripting

The Availability Calendar WordPress plugin before 1.2.2 does not sanitise or escape its Category Names before outputting them in page/post where the associated shortcode is embed, allowing high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html is disallowed

CVSS 3.1 · 4.8 Medium EPSS < 1% KEV · Not listed
Vendors
Offshorewebmaster
Products
Availability Calendar
CVE-2021-24603

Site Reviews < 5.13.1 - Authenticated Stored XSS

The Site Reviews WordPress plugin before 5.13.1 does not sanitise some of its Review Details when adding a review as an admin, which could allow them to perform Cross-Site Scripting attacks when the unfiltered_html is disallowed

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed
Vendors
Geminilabs
Products
Site Reviews