Total
42233 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2021-24683 | 1 Awplife | 1 Weather Effect | 2024-11-21 | 4.3 MEDIUM | 5.4 MEDIUM |
|
The Weather Effect WordPress plugin before 1.3.4 does not have any CSRF checks in place when saving its settings, and do not validate or escape them, which could lead to Stored Cross-Site Scripting issue.
|
|||||
| CVE-2021-24682 | 1 Wpkube | 1 Cool Tag Cloud | 2024-11-21 | 3.5 LOW | 5.4 MEDIUM |
|
The Cool Tag Cloud WordPress plugin before 2.26 does not escape the style attribute of the cool_tag_cloud shortcode, which could allow users with a role as low as Contributor to perform Stored Cross-Site Scripting attacks.
|
|||||
| CVE-2021-24681 | 1 Duplicatepro | 1 Duplicate Page | 2024-11-21 | 3.5 LOW | 4.8 MEDIUM |
|
The Duplicate Page WordPress plugin through 4.4.2 does not sanitise or escape the Duplicate Post Suffix settings before outputting it, which could allow high privilege users to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed.
|
|||||
| CVE-2021-24680 | 1 Wptravelengine | 1 Wp Travel Engine | 2024-11-21 | 3.5 LOW | 5.4 MEDIUM |
|
The WP Travel Engine WordPress plugin before 5.3.1 does not escape the Description field in the Trip Destination/Activities/Trip Type and Pricing Category pages, allowing users with a role as low as editor to perform Stored Cross-Site Scripting attacks, even when the unfiltered_html capability is disallowed
|
|||||
| CVE-2021-24679 | 1 Coinmarketstats | 1 Bitcoin \/ Altcoin Payment Gateway For Woocommerce | 2024-11-21 | 4.3 MEDIUM | 6.1 MEDIUM |
|
The Bitcoin / AltCoin Payment Gateway for WooCommerce WordPress plugin before 1.6.1 does not escape the 's' GET parameter before outputting back in the All Masking Rules page, leading to a Reflected Cross-Site Scripting issue
|
|||||
| CVE-2021-24678 | 1 Cminds | 1 Tooltip Glossary | 2024-11-21 | 3.5 LOW | 5.4 MEDIUM |
|
The CM Tooltip Glossary WordPress plugin before 3.9.21 does not escape some glossary_tooltip shortcode attributes, which could allow users a role as low as Contributor to perform Stored Cross-Site Scripting attacks
|
|||||
| CVE-2021-24676 | 1 Codesolz | 1 Better Find And Replace | 2024-11-21 | 4.3 MEDIUM | 6.1 MEDIUM |
|
The Better Find and Replace WordPress plugin before 1.2.9 does not escape the 's' GET parameter before outputting back in the All Masking Rules page, leading to a Reflected Cross-Site Scripting issue
|
|||||
| CVE-2021-24673 | 1 Dwbooster | 1 Appointment Hour Booking | 2024-11-21 | 3.5 LOW | 4.8 MEDIUM |
|
The Appointment Hour Booking WordPress plugin before 1.3.16 does not escape some of the Calendar Form settings, allowing high privilege users to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed.
|
|||||
| CVE-2021-24672 | 1 Onedesigns | 1 One User Avatar | 2024-11-21 | 3.5 LOW | 5.4 MEDIUM |
|
The One User Avatar WordPress plugin before 2.3.7 does not escape the link and target attributes of its shortcode, allowing users with a role as low as Contributor to perform Stored Cross-Site Scripting attacks
|
|||||
| CVE-2021-24671 | 1 Mx Time Zone Clocks Project | 1 Mx Time Zone Clocks | 2024-11-21 | 3.5 LOW | 5.4 MEDIUM |
|
The MX Time Zone Clocks WordPress plugin before 3.4.1 does not escape the time_zone attribute of the mxmtzc_time_zone_clocks shortcode, allowing users with a role as low as Contributor to perform Stored Cross-Site Scripting attacks
|
|||||
| CVE-2021-24670 | 1 Status301 | 1 Coolclock | 2024-11-21 | 3.5 LOW | 5.4 MEDIUM |
|
The CoolClock WordPress plugin before 4.3.5 does not escape some shortcode attributes, allowing users with a role as low as Contributor toperform Stored Cross-Site Scripting attacks
|
|||||
| CVE-2021-24667 | 1 Simplygallery | 1 Simply Gallery Blocks With Lightbox | 2024-11-21 | 3.5 LOW | 5.4 MEDIUM |
|
A stored cross-site scripting vulnerability has been discovered in : Simply Gallery Blocks with Lightbox (Version – 2.2.0 & below). The vulnerability exists in the Lightbox functionality where a user with low privileges is allowed to execute arbitrary script code within the context of the application. This vulnerability is due to insufficient validation of image parameters in meta data.
|
|||||
| CVE-2021-24665 | 1 Tipsandtricks-hq | 1 Wp Video Lightbox | 2024-11-21 | 3.5 LOW | 5.4 MEDIUM |
|
The WP Video Lightbox WordPress plugin before 1.9.3 does not escape the attributes of its shortcodes, allowing users with a role as low as contributor to perform Cross-Site Scripting attacks
|
|||||
| CVE-2021-24664 | 1 Igexsolutions | 1 Wpschoolpress | 2024-11-21 | 3.5 LOW | 4.8 MEDIUM |
|
The School Management System – WPSchoolPress WordPress plugin before 2.1.17 sanitise some fields using sanitize_text_field() but does not escape them before outputting in attributes, resulting in Stored Cross-Site Scripting issues.
|
|||||
| CVE-2021-24660 | 1 Wpxpo | 1 Postx - Gutenberg Blocks For Post Grid | 2024-11-21 | 3.5 LOW | 5.4 MEDIUM |
|
The PostX – Gutenberg Blocks for Post Grid WordPress plugin before 2.4.10, with Saved Templates Addon enabled, allows users with a role as low as Contributor to perform Stored Cross-Site Scripting attacks via the plugin's shortcode.
|
|||||
| CVE-2021-24659 | 1 Wpxpo | 1 Postx - Gutenberg Blocks For Post Grid | 2024-11-21 | 3.5 LOW | 5.4 MEDIUM |
|
The PostX – Gutenberg Blocks for Post Grid WordPress plugin before 2.4.10 allows users with a role as low as Contributor to perform Stored Cross-Site Scripting attacks via the plugin's block.
|
|||||
| CVE-2021-24658 | 1 Erident Custom Login And Dashboard Project | 1 Erident Custom Login And Dashboard | 2024-11-21 | 3.5 LOW | 4.8 MEDIUM |
|
The Erident Custom Login and Dashboard WordPress plugin before 3.5.9 did not properly sanitise its settings, allowing high privilege users to use XSS payloads in them (even when the unfileted_html is disabled)
|
|||||
| CVE-2021-24657 | 1 Limit Login Attempts Project | 1 Limit Login Attempts | 2024-11-21 | 4.3 MEDIUM | 6.1 MEDIUM |
|
The Limit Login Attempts WordPress plugin before 4.0.50 does not escape the IP addresses (which can be controlled by attacker via headers such as X-Forwarded-For) of attempted logins before outputting them in the reports table, leading to an Unauthenticated Stored Cross-Site Scripting issue.
|
|||||
| CVE-2021-24656 | 1 Wpbrigade | 1 Simple Social Buttons | 2024-11-21 | 3.5 LOW | 4.8 MEDIUM |
|
The Simple Social Media Share Buttons WordPress plugin before 3.2.4 does not escape the Share Title settings before outputting it in the frontend pages or posts (depending on the settings used), allowing high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed.
|
|||||
| CVE-2021-24654 | 1 Wpeverest | 1 User Registration | 2024-11-21 | 3.5 LOW | 5.4 MEDIUM |
|
The User Registration WordPress plugin before 2.0.2 does not properly sanitise the user_registration_profile_pic_url value when submitted directly via the user_registration_update_profile_details AJAX action. This could allow any authenticated user, such as subscriber, to perform Stored Cross-Site attacks when their profile is viewed
|
|||||
| CVE-2021-24653 | 1 Cookie-bar Project | 1 Cookie-bar | 2024-11-21 | 3.5 LOW | 4.8 MEDIUM |
|
The Cookie Bar WordPress plugin before 1.8.9 doesn't properly sanitise the Cookie Bar Message setting, which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed
|
|||||
| CVE-2021-24648 | 1 Metagauss | 1 Registrationmagic | 2024-11-21 | 4.3 MEDIUM | 6.1 MEDIUM |
|
The RegistrationMagic WordPress plugin before 5.0.1.9 does not sanitise and escape the rm_search_value parameter before outputting back in an attribute, leading to a Reflected Cross-Site Scripting
|
|||||
| CVE-2021-24646 | 1 Bookingholdings | 1 Booking.com Banner Creator | 2024-11-21 | 3.5 LOW | 4.8 MEDIUM |
|
The Booking.com Banner Creator WordPress plugin before 1.4.3 does not properly sanitize inputs when creating banners, which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed
|
|||||
| CVE-2021-24645 | 1 Bookingholdings | 1 Booking.com Product Helper | 2024-11-21 | 3.5 LOW | 4.8 MEDIUM |
|
The Booking.com Product Helper WordPress plugin before 1.0.2 does not sanitize and escape Product Code when creating Product Shortcode, which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed
|
|||||
| CVE-2021-24643 | 1 Wp Map Block Project | 1 Wp Map Block | 2024-11-21 | 3.5 LOW | 5.4 MEDIUM |
|
The WP Map Block WordPress plugin before 1.2.3 does not escape some attributes of the WP Map Block, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks
|
|||||
| CVE-2021-24642 | 1 Scroll Banner Project | 1 Scroll Banner | 2024-11-21 | 4.3 MEDIUM | 6.5 MEDIUM |
|
The Scroll Baner WordPress plugin through 1.0 does not have CSRF check in place when saving its settings, nor perform any sanitisation, escaping or validation on them. This could allow attackers to make logged in admin change them and could lead to RCE (via a file upload) as well as XSS
|
|||||
| CVE-2021-24640 | 1 Gutenslider | 1 Gutenslider | 2024-11-21 | 3.5 LOW | 5.4 MEDIUM |
|
The WordPress Slider Block Gutenslider plugin before 5.2.0 does not escape the minWidth attribute of a Gutenburg block, which could allow users with a role as low as contributor to perform Cross-Site Scripting attacks
|
|||||
| CVE-2021-24637 | 1 Fontsplugin | 1 Fonts | 2024-11-21 | 3.5 LOW | 5.4 MEDIUM |
|
The Google Fonts Typography WordPress plugin before 3.0.3 does not escape and sanitise some of its block settings, allowing users with as role as low as Contributor to perform Stored Cross-Site Scripting attacks via blockType (combined with content), align, color, variant and fontID argument of a Gutenberg block.
|
|||||
| CVE-2021-24634 | 1 Wpzoom | 1 Recipe Card Blocks For Gutenberg \& Elementor | 2024-11-21 | 3.5 LOW | 5.4 MEDIUM |
|
The Recipe Card Blocks by WPZOOM WordPress plugin before 2.8.3 does not properly sanitise or escape some of the properties of the Recipe Card Block (such as ingredientsLayout, iconSet, steps, ingredients, recipeTitle, or settings), which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks.
|
|||||
| CVE-2021-24632 | 1 Wpzoom | 1 Recipe Card Blocks For Gutenberg \& Elementor | 2024-11-21 | 4.3 MEDIUM | 6.1 MEDIUM |
|
The Recipe Card Blocks by WPZOOM WordPress plugin before 2.8.1 does not escape the message parameter before outputting it back in the admin dashboard, leading to a Reflected Cross-Site Scripting issue
|
|||||
| CVE-2021-24624 | 1 Sonaar | 1 Mp3 Audio Player For Music\, Radio \& Podcast | 2024-11-21 | 3.5 LOW | 4.8 MEDIUM |
|
The MP3 Audio Player for Music, Radio & Podcast by Sonaar WordPress plugin before 2.4.2 does not properly sanitize or escape data in some of its Playlist settings, allowing high privilege users to perform Cross-Site Scripting attacks
|
|||||
| CVE-2021-24623 | 1 Ticket-system | 1 Wordpress Advanced Ticket System | 2024-11-21 | 3.5 LOW | 4.8 MEDIUM |
|
The WordPress Advanced Ticket System, Elite Support Helpdesk WordPress plugin before 1.0.64 does not sanitize or escape form values before saving to the database or when outputting, which allows high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed.
|
|||||
| CVE-2021-24622 | 1 Emarketdesign | 1 Customer Service Software \& Support Ticket System | 2024-11-21 | 3.5 LOW | 4.8 MEDIUM |
|
The Customer Service Software & Support Ticket System WordPress plugin before 5.10.4 does not sanitize or escape form fields before outputting it in the List, which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed.
|
|||||
| CVE-2021-24621 | 1 Stratospheredigital | 1 Wp Courses Lms | 2024-11-21 | 3.5 LOW | 4.8 MEDIUM |
|
The WP Courses LMS WordPress plugin before 2.0.44 does not sanitise its Video Embed Code, allowing malicious code to be injected in it by high privilege users, even when the unfiltered_html capability is disallowed, which could lead to Stored Cross-Site Scripting issues
|
|||||
| CVE-2021-24619 | 1 Evona | 1 Per Page Add To Head | 2024-11-21 | 3.5 LOW | 4.8 MEDIUM |
|
The Per page add to head WordPress plugin through 1.4.4 does not properly sanitise one of its setting, allowing malicious HTML to be inserted by high privilege users even when the unfiltered_html capability is disallowed, which could lead to Cross-Site Scripting issues.
|
|||||
| CVE-2021-24618 | 1 Wbolt | 1 Donate With Qrcode | 2024-11-21 | 3.5 LOW | 5.4 MEDIUM |
|
The Donate With QRCode WordPress plugin before 1.4.5 does not sanitise or escape its QRCode Image setting, which result into a Stored Cross-Site Scripting (XSS). Furthermore, the plugin also does not have any CSRF and capability checks in place when saving such setting, allowing any authenticated user (as low as subscriber), or unauthenticated user via a CSRF vector to update them and perform such attack.
|
|||||
| CVE-2021-24617 | 1 Gamepress Project | 1 Gamepress | 2024-11-21 | 4.3 MEDIUM | 6.1 MEDIUM |
|
The GamePress WordPress plugin through 1.1.0 does not escape the op_edit POST parameter before outputting it back in multiple Game Option pages, leading to Reflected Cross-Site Scripting issues
|
|||||
| CVE-2021-24616 | 1 Addtoany | 1 Addtoany Share Buttons | 2024-11-21 | 3.5 LOW | 4.8 MEDIUM |
|
The AddToAny Share Buttons WordPress plugin before 1.7.48 does not escape its Image URL button setting, which could lead allow high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed.
|
|||||
| CVE-2021-24615 | 1 Wechat Reward Project | 1 Wechat Reward | 2024-11-21 | 4.3 MEDIUM | 5.4 MEDIUM |
|
The Wechat Reward WordPress plugin through 1.7 does not sanitise or escape its QR settings, nor has any CSRF check in place, allowing attackers to make a logged in admin change the settings and perform Cross-Site Scripting attacks.
|
|||||
| CVE-2021-24614 | 1 Oz-plugin | 1 Book Appointment Online | 2024-11-21 | 3.5 LOW | 4.8 MEDIUM |
|
The Book appointment online WordPress plugin before 1.39 does not sanitise or escape Service Prices before outputting it in the List, which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed.
|
|||||