Live Vulnerability Intelligence
Threat Database
Search CVEs, inspect descriptions, and open detail pages with AI-assisted technical context.
Threat Entry
Updated 2024-11-21
CVE-2021-24423 - Before 1 Plugin
The UpdraftPlus WordPress Backup Plugin WordPress plugin before 1.6.59 does not sanitise its updraft_service settings, allowing high privilege users to set malicious JavaScript payload in it and leading to a Stored Cross-Site Scripting issue
PLUGIN
Before 1
CVE-2021-24423
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2021-24733 - Before 1 Plugin
The WP Post Page Clone WordPress plugin before 1.2 allows users with a role as low as Contributor to clone and view other users' draft and password-protected posts which they cannot view normally.
PLUGIN
Before 1
CVE-2021-24733
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2021-25067 - Before 1 Plugin
The Landing Page Builder WordPress plugin before 1.4.9.6 was affected by a reflected XSS in page-builder-add on the ulpb_post admin page.
PLUGIN
Before 1
CVE-2021-25067
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2021-25024 - Before 1 Plugin
The EventCalendar WordPress plugin before 1.1.51 does not escape some user input before outputting it back in attributes, leading to Reflected Cross-SIte Scripting issues
PLUGIN
Before 1
CVE-2021-25024
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2021-24909 - Before 1 Plugin
The ACF Photo Gallery Field WordPress plugin before 1.7.5 does not sanitise and escape the post parameter in the includes/acf_photo_gallery_metabox_edit.php file before outputing back in an attribute, leading to a Reflected Cross-Site Scripting issue
PLUGIN
Before 1
CVE-2021-24909
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2021-25005 - Before 1 Plugin
The SEUR Oficial WordPress plugin before 1.7.0 does not sanitize and escape some of its settings allowing high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed
PLUGIN
Before 1
CVE-2021-25005
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2021-25025 - Before 1 Plugin
The EventCalendar WordPress plugin before 1.1.51 does not have proper authorisation and CSRF checks in the add_calendar_event AJAX actions, allowing users with a role as low as subscriber to create events
PLUGIN
Before 1
CVE-2021-25025
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2021-25047 - Before 1 Plugin
The 10Web Social Photo Feed WordPress plugin before 1.4.29 was affected by a reflected Cross-Site Scripting (XSS) vulnerability in the wdi_apply_changes admin page, allowing an attacker to perform such attack against any logged in users
PLUGIN
Before 1
CVE-2021-25047
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2021-25043 - Before 1 Plugin
The WOOCS WordPress plugin before 1.3.7.3 does not sanitise and escape the custom_prices parameter before outputting it back in the response, leading to a Reflected Cross-Site Scripting issue
PLUGIN
Before 1
CVE-2021-25043
Risk Score
Threat Entry
Updated 2025-05-22
CVE-2021-25022 - Before 1 Plugin
The UpdraftPlus WordPress Backup Plugin WordPress plugin before 1.16.66 does not sanitise and escape the backup_timestamp and job_id parameter before outputting then back in admin pages, leading to Reflected Cross-Site Scripting issues
PLUGIN
Before 1
CVE-2021-25022
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2021-24831 - Before 1 Plugin
All AJAX actions of the Tab WordPress plugin before 1.3.2 are available to both unauthenticated and authenticated users, allowing unauthenticated attackers to modify various data in the plugin, such as add/edit/delete arbitrary tabs.
PLUGIN
Before 1
CVE-2021-24831
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2021-24828 - Before 1 Plugin
The Mortgage Calculator / Loan Calculator WordPress plugin before 1.5.17 does not escape the some of the attributes of its mlcalc shortcode before outputting them, which could allow users with a role as low as contributor to perform Cross-Site Scripting attacks
PLUGIN
Before 1
CVE-2021-24828
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2021-24997 - Before 1 Plugin
The WP Guppy WordPress plugin before 1.3 does not have any authorisation in some of the REST API endpoints, allowing any user to call them and could lead to sensitive information disclosure, such as usernames and chats between users, as well as be able to send messages as an arbitrary user
PLUGIN
Before 1
CVE-2021-24997
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2021-24967 - Before 1 Plugin
The Contact Form & Lead Form Elementor Builder WordPress plugin before 1.6.4 does not sanitise and escape some lead values, which could allow unauthenticated users to perform Cross-Site Scripting attacks against logged in admin viewing the inserted Leads
PLUGIN
Before 1
CVE-2021-24967
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2021-24753 - Before 1 Plugin
The Rich Reviews by Starfish WordPress plugin before 1.9.6 does not properly validate the orderby GET parameter of the pending reviews page before using it in a SQL statement, leading to an authenticated SQL injection issue
PLUGIN
Before 1
CVE-2021-24753
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2021-24902 - Before 1 Plugin
The Typebot | Build beautiful conversational forms WordPress plugin before 1.4.3 does not sanitise and escape the Publish ID setting, which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed.
PLUGIN
Before 1
CVE-2021-24902
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2021-24846 - Before 1 Plugin
The get_query() function of the Ni WooCommerce Custom Order Status WordPress plugin before 1.9.7, used by the niwoocos_ajax AJAX action, available to all authenticated users, does not properly sanitise the sort parameter before using it in a SQL statement, leading to an SQL injection, exploitable by any authenticated users, such as subscriber
PLUGIN
Before 1
CVE-2021-24846
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2021-24907 - Before 1 Plugin
The Contact Form, Drag and Drop Form Builder for WordPress plugin before 1.8.0 does not escape the status parameter before outputting it back in an attribute, leading to a Reflected Cross-Site Scripting issue
PLUGIN
Before 1
CVE-2021-24907
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2021-24855 - Before 1 Plugin
The Display Post Metadata WordPress plugin before 1.5.0 adds a shortcode to print out custom fields, however their content is not sanitised or escaped which could allow users with a role as low as Contributor to perform Cross-Site Scripting attacks
PLUGIN
Before 1
CVE-2021-24855
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2021-24896 - Before 1 Plugin
The Caldera Forms WordPress plugin before 1.9.5 does not sanitise and escape the Form Name before outputting it in attributes, which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed.
PLUGIN
Before 1
CVE-2021-24896
Risk Score