CVE-2021-24464

YouTube Embed, Playlist and Popup < 2.3.9 - Contributor+ Stored XSS

The YouTube Embed, Playlist and Popup by WpDevArt WordPress plugin before 2.3.9 did not escape, validate or sanitise some of its shortcode options, available to users with a role as low as Contributor, leading to an authenticated Stored Cross-Site Scripting issue.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed

Vendors

Wpdevart

Products

Youtube Embed\, Playlist And Popup

CVE-2021-24463

Image Slider by Ays - Responsive Slider and Carousel < 2.5.0 - Authenticated Blind SQL Injection

The get_sliders() function in the Image Slider by Ays- Responsive Slider and Carousel WordPress plugin before 2.5.0 did not use whitelist or validate the orderby parameter before using it in SQL statements passed to the get_results() DB calls, leading to SQL injection issues in the admin dashboard

CVSS 3.1 · 8.8 High EPSS 1.4% KEV · Not listed

Vendors

Ays-pro

Products

Image Slider

CVE-2021-24462

Photo Gallery by Ays - Responsive Image Gallery < 4.4.4 - Authenticated Blind SQL Injections

The get_gallery_categories() and get_galleries() functions in the Photo Gallery by Ays – Responsive Image Gallery WordPress plugin before 4.4.4 did not use whitelist or validate the orderby parameter before using it in SQL statements passed to the get_results() DB calls, leading to SQL injection issues in the admin dashboard

CVSS 3.1 · 8.8 High EPSS 1.4% KEV · Not listed

Vendors

Ays-pro

Products

Photo Gallery

CVE-2021-24461

FAQ Builder < 1.3.6 - Authenticated Blind SQL Injections

The get_faqs() function in the FAQ Builder AYS WordPress plugin before 1.3.6 did not use whitelist or validate the orderby parameter before using it in SQL statements passed to the get_results() DB calls, leading to SQL injection issues in the admin dashboard

CVSS 3.1 · 8.8 High EPSS 1.4% KEV · Not listed

Vendors

Ays-pro

Products

Faq Builder

CVE-2021-24460

Popup Like box - Page Plugin < 3.5.3 - Authenticated Blind SQL Injections

The get_fb_likeboxes() function in the Popup Like box – Page Plugin WordPress plugin before 3.5.3 did not use whitelist or validate the orderby parameter before using it in SQL statements passed to the get_results() DB calls, leading to SQL injection issues in the admin dashboard

CVSS 3.1 · 8.8 High EPSS 1.4% KEV · Not listed

Vendors

Ays-pro

Products

Popup Box

CVE-2021-24459

Survey Maker < 1.5.6 - Authenticated Blind SQL Injections

The get_results() and get_items() functions in the Survey Maker WordPress plugin before 1.5.6 did not use whitelist or validate the orderby parameter before using it in SQL statements passed to the get_results() DB calls, leading to SQL injection issues in the admin dashboard

CVSS 3.1 · 8.8 High EPSS 1.4% KEV · Not listed

Vendors

Ays-pro

Products

Survey Maker

CVE-2021-24458

Popup box < 2.3.4 - Authenticated Blind SQL Injections

The get_ays_popupboxes() and get_popup_categories() functions of the Popup box WordPress plugin before 2.3.4 did not use whitelist or validate the orderby parameter before using it in SQL statements passed to the get_results() DB calls, leading to SQL injection issues in the admin dashboard

CVSS 3.1 · 8.8 High EPSS 1.4% KEV · Not listed

Vendors

Ays-pro

Products

Popup Box

CVE-2021-24457

Portfolio Responsive Gallery < 1.1.8 - Authenticated Blind SQL Injections

The get_portfolios() and get_portfolio_attributes() functions in the class-portfolio-responsive-gallery-list-table.php and class-portfolio-responsive-gallery-attributes-list-table.php files of the Portfolio Responsive Gallery WordPress plugin before 1.1.8 did not use whitelist or validate the orderby parameter before using it in SQL statements passed to the get_results() DB calls, leading to SQL injection issues in the admin dashboard

CVSS 3.1 · 8.8 High EPSS 1.4% KEV · Not listed

Vendors

Ays-pro

Products

Portfolio Responsive Gallery

CVE-2021-24456

Quiz Maker < 6.2.0.9 - Multiple Authenticated Blind SQL Injections

The Quiz Maker WordPress plugin before 6.2.0.9 did not properly sanitise and escape the order and orderby parameters before using them in SQL statements, leading to SQL injection issues in the admin dashboard

CVSS 3.1 · 7.2 High EPSS 1.3% KEV · Not listed

Vendors

Ays-pro

Products

Quiz Maker

CVE-2021-24455

Tutor LMS < 1.9.2 - Authenticated Stored Cross-Site Scripting (XSS)

The Tutor LMS – eLearning and online course solution WordPress plugin before 1.9.2 did not escape the Summary field of Announcements (when outputting it in an attribute), which can be created by users as low as Tutor Instructor. This lead to a Stored Cross-Site Scripting issue, which is triggered when viewing the Announcements list, and could result in privilege escalation when viewed by an admin.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed

Vendors

Themeum

Products

Tutor Lms

CVE-2021-24454

YOP Poll < 6.2.8 - Stored Cross-Site Scripting

In the YOP Poll WordPress plugin before 6.2.8, when a pool is created with the options "Allow other answers", "Display other answers in the result list" and "Show results", it can lead to Stored Cross-Site Scripting issues as the 'Other' answer is not sanitised before being output in the page. The execution of the XSS payload depends on the 'Show results' option selected, which could be before or after sending the vote for example.

CVSS 3.1 · 6.1 Medium EPSS 1.6% KEV · Not listed

Vendors

Yop-poll

Products

Yop Poll

CVE-2021-24453

Include Me <= 1.2.1 - Authenticated Remote Code Execution (RCE) via LFI log poisoning

The Include Me WordPress plugin through 1.2.1 is vulnerable to path traversal / local file inclusion, which can lead to Remote Code Execution (RCE) of the system due to log poisoning and therefore potentially a full compromise of the underlying structure

CVSS 3.1 · 8.8 High EPSS 5.0% KEV · Not listed

Vendors

Include Me Project

Products

Include Me

CVE-2021-24452

W3 Total Cache < 2.1.5 - Reflected XSS in Extensions Page (JS Context)

The W3 Total Cache WordPress plugin before 2.1.5 was affected by a reflected Cross-Site Scripting (XSS) issue within the "extension" parameter in the Extensions dashboard, when the 'Anonymously track usage to improve product quality' setting is enabled, as the parameter is output in a JavaScript context without proper escaping. This could allow an attacker, who can convince an authenticated admin into clicking a link, to run malicious JavaScript within the user's web browser, which could lead to full site compromise.

CVSS 3.1 · 6.1 Medium EPSS 1.9% KEV · Not listed

Vendors

Boldgrid

Products

W3 Total Cache

CVE-2021-24451

Export Users With Meta < 0.6.5 - Authenticated SQL Injection

The Export Users With Meta WordPress plugin before 0.6.5 did not escape the list of roles to export before using them in a SQL statement in the export functionality, available to admins, leading to an authenticated SQL Injection.

CVSS 3.1 · 7.2 High EPSS 1.4% KEV · Not listed

Vendors

Export Users With Meta Project

Products

Export Users With Meta

CVE-2021-24450

ProfilePress < 3.1.8 - Authenticated Stored XSS

The User Registration, User Profiles, Login & Membership – ProfilePress (Formerly WP User Avatar) WordPress plugin before 3.1.8 did not sanitise or escape some of its settings before saving them and outputting them back in the page, allowing high privilege users such as admin to set JavaScript payloads in them even when the unfiltered_html capability is disallowed, leading to an authenticated Stored Cross-Site Scripting issue

CVSS 3.1 · 4.8 Medium EPSS < 1% KEV · Not listed

Vendors

Properfraction

Products

Profilepress

CVE-2021-24448

Profile Builder < 3.4.8 - Authenticated Stored XSS

The User Registration & User Profile – Profile Builder WordPress plugin before 3.4.8 does not sanitise or escape its 'Modify default Redirect Delay timer' setting, allowing high privilege users to use JavaScript code in it, even when the unfiltered_html capability is disallowed, leading to an authenticated Stored Cross-Site Scripting issue

CVSS 3.1 · 4.8 Medium EPSS < 1% KEV · Not listed

Vendors

Cozmoslabs

Products

Profile Builder

CVE-2021-24447

WP Image Zoom < 1.47 - Local File Inclusion

The WP Image Zoom WordPress plugin before 1.47 did not validate its tab parameter before using it in the include_once() function, leading to a local file inclusion issue in the admin dashboard

CVSS 3.1 · 5.3 Medium EPSS 1.4% KEV · Not listed

Vendors

Silkypress

Products

Wp Image Zoom

CVE-2021-24446

Remove Footer Credit < 1.0.6 - CSRF to Stored Cross-Site Scripting

The Remove Footer Credit WordPress plugin before 1.0.6 does not have CSRF check in place when saving its settings, which could allow attacker to make logged in admins change them and lead to Stored XSS issue as well due to the lack of sanitisation

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed

Vendors

Wpchill

Products

Remove Footer Credit

CVE-2021-24445

My Site Audit <= 1.2.4 - Authenticated Stored Cross-Site Scripting (XSS)

The My Site Audit WordPress plugin through 1.2.4 does not sanitise or escape the Audit Name field when creating an audit, allowing high privilege users to set JavaScript payloads in them, even when he unfiltered_html capability is disallowed, leading to an authenticated Stored Cross-Site Scripting issue

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed

Vendors

Draftpress

Products

My Site Audit

CVE-2021-24444

TaxoPress < 3.0.7.2 - Authenticated Stored Cross-Site Scripting (XSS)

The TaxoPress – Create and Manage Taxonomies, Tags, Categories WordPress plugin before 3.0.7.2 does not sanitise its Taxonomy description field, allowing high privilege users to set JavaScript payload in them even when the unfiltered_html capability is disallowed, leading to an authenticated Stored Cross-Site Scripting issue.

CVSS 3.1 · 4.8 Medium EPSS 2.3% KEV · Not listed

Vendors

Taxopress

Products

Taxopress