Search

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Search Examples

CVEs in KEV CVEs with EPSS >= 80% Crit. Microsoft High Apache SQL Injection (CWE-89) Linux Kernel High (CVSS 3.1) Apache Struts RCE (Remote Code Execution) XSS (CWE-79) Critical (CVSS 4.0) CVEs to check

Search Results (18006 CVEs found)

CVE Vendors Products Updated CVSS v3.1
CVE-2021-38343 1 Kylephillips 1 Nested Pages 2024-11-21 4.7 Medium
The Nested Pages WordPress plugin <= 3.1.15 was vulnerable to an Open Redirect via the `page` POST parameter in the `npBulkActions`, `npBulkEdit`, `npListingSort`, and `npCategoryFilter` `admin_post` actions.
CVE-2021-38342 1 Kylephillips 1 Nested Pages 2024-11-21 8.1 High
The Nested Pages WordPress plugin <= 3.1.15 was vulnerable to Cross-Site Request Forgery via the `npBulkAction`s and `npBulkEdit` `admin_post` actions, which allowed attackers to trash or permanently purge arbitrary posts as well as changing their status, reassigning their ownership, and editing other metadata.
CVE-2021-37597 1 Wpcerber 1 Wp Cerber 2024-11-21 9.8 Critical
WP Cerber before 8.9.3 allows MFA bypass via wordpress_logged_in_[hash] manipulation.
CVE-2021-36905 1 Expresstech 1 Quiz And Survey Master 2024-11-21 5.4 Medium
Multiple Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerabilities in Quiz And Survey Master plugin <= 7.3.4 on WordPress.
CVE-2021-36870 1 Codecabin 1 Wp Go Maps 2024-11-21 5.5 Medium
Multiple Authenticated Persistent Cross-Site Scripting (XSS) vulnerabilities in WordPress WP Google Maps plugin (versions <= 8.1.12). Vulnerable parameters: &dataset_name, &wpgmza_gdpr_retention_purpose, &wpgmza_gdpr_company_name, &name #2, &name, &polyname #2, &polyname, &address.
CVE-2021-36832 1 Icegram 1 Icegram Engage 2024-11-21 4.8 Medium
WordPress Popups, Welcome Bar, Optins and Lead Generation Plugin – Icegram (versions <= 2.0.2) vulnerable at "Headline" (&message_data[16][headline]) input.
CVE-2021-36827 1 Ninjaforms 1 Ninja Forms 2024-11-21 4.8 Medium
Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Saturday Drive's Ninja Forms Contact Form plugin <= 3.6.9 at WordPress via "label".
CVE-2021-36823 2 Cusmin, Wordpress 2 Absolutely Glamorous Custom Admin, Absolutely Glamorous Custom Admin 2024-11-21 6.6 Medium
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Cusmin AGCA - Absolutely Glamorous Custom Admin (WordPress plugin) allows Stored XSS.This issue affects AGCA - Absolutely Glamorous Custom Admin (WordPress plugin): from n/a through 6.8.
CVE-2021-34637 1 Post Index Project 1 Post Index 2024-11-21 8.8 High
The Post Index WordPress plugin is vulnerable to Cross-Site Request Forgery via the OptionsPage function found in the ~/php/settings.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 0.7.5.
CVE-2021-34635 1 Ays-pro 1 Poll Maker 2024-11-21 6.1 Medium
The Poll Maker WordPress plugin is vulnerable to Reflected Cross-Site Scripting via the mcount parameter found in the ~/admin/partials/settings/poll-maker-settings.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 3.2.8.
CVE-2021-34634 1 Sola-newsletters Project 1 Sola-newsletters 2024-11-21 8.8 High
The Nifty Newsletters WordPress plugin is vulnerable to Cross-Site Request Forgery via the sola_nl_wp_head function found in the ~/sola-newsletters.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 4.0.23.
CVE-2021-34633 1 Youtube Feeder Project 1 Youtube Feeder 2024-11-21 8.8 High
The Youtube Feeder WordPress plugin is vulnerable to Cross-Site Request Forgery via the printAdminPage function found in the ~/youtube-feeder.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 2.0.1.
CVE-2021-34632 1 Seo Backlinks Project 1 Seo Backlinks 2024-11-21 8.8 High
The SEO Backlinks WordPress plugin is vulnerable to Cross-Site Request Forgery via the loc_config function found in the ~/seo-backlinks.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 4.0.1.
CVE-2021-34631 1 Ipdgroup 1 Newsplugin 2024-11-21 8.8 High
The NewsPlugin WordPress plugin is vulnerable to Cross-Site Request Forgery via the handle_save_style function found in the ~/news-plugin.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 1.0.18.
CVE-2021-34629 1 Sendgrid 1 Sendgrid 2024-11-21 4.3 Medium
The SendGrid WordPress plugin is vulnerable to authorization bypass via the get_ajax_statistics function found in the ~/lib/class-sendgrid-statistics.php file which allows authenticated users to export statistic for a WordPress multi-site main site, in versions up to and including 1.11.8.
CVE-2021-34628 1 Weblizar 1 Admin Custom Login 2024-11-21 8.8 High
The Admin Custom Login WordPress plugin is vulnerable to Cross-Site Request Forgery due to the loginbgSave action found in the ~/includes/Login-form-setting/Login-form-background.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 3.2.7.
CVE-2021-34627 1 Wp-upload-restriction Project 1 Wp-upload-restriction 2024-11-21 4.3 Medium
A vulnerability in the getSelectedMimeTypesByRole function of the WP Upload Restriction WordPress plugin allows low-level authenticated users to view custom extensions added by administrators. This issue affects versions 2.2.3 and prior.
CVE-2021-34626 1 Wp-upload-restriction Project 1 Wp-upload-restriction 2024-11-21 4.3 Medium
A vulnerability in the deleteCustomType function of the WP Upload Restriction WordPress plugin allows low-level authenticated users to delete custom extensions added by administrators. This issue affects versions 2.2.3 and prior.
CVE-2021-34625 1 Wp-upload-restriction Project 1 Wp-upload-restriction 2024-11-21 6.4 Medium
A vulnerability in the saveCustomType function of the WP Upload Restriction WordPress plugin allows low-level authenticated users to inject arbitrary web scripts. This issue affects versions 2.2.3 and prior.
CVE-2021-34624 1 Properfraction 1 Profilepress 2024-11-21 9.8 Critical
A vulnerability in the file uploader component found in the ~/src/Classes/FileUploader.php file of the ProfilePress WordPress plugin made it possible for users to upload arbitrary files during user registration or during profile updates. This issue affects versions 3.0.0 - 3.1.3. .