Live Vulnerability Intelligence
Threat Database
Search CVEs, inspect descriptions, and open detail pages with AI-assisted technical context.
Threat Entry
Updated 2024-11-21
CVE-2021-24486 - Before 3 Plugin
The Simple Social Media Share Buttons – Social Sharing for Everyone WordPress plugin before 3.2.3 did not escape the align and like_button_size parameters of its SSB shortcode, which could allow users with a role as low as Contributor to perform Stored Cross-Site Scripting attacks.
PLUGIN
Before 3
CVE-2021-24486
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2021-24527 - Before 3 Plugin
The User Registration & User Profile – Profile Builder WordPress plugin before 3.4.9 has a bug allowing any user to reset the password of the admin of the blog, and gain unauthorised access, due to a bypass in the way the reset key is checked. Furthermore, the admin will not be notified of such change by email for example.
PLUGIN
Before 3
CVE-2021-24527
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2021-24512 - Before 3 Plugin
The Video Posts Webcam Recorder WordPress plugin before 3.2.4 has an authenticated reflected cross site scripting (XSS) vulnerability in one of the administrative functions for handling deletion of videos.
PLUGIN
Before 3
CVE-2021-24512
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2021-24522 - Before 3 Plugin
The User Registration, User Profile, Login & Membership – ProfilePress (Formerly WP User Avatar) WordPress plugin before 3.1.11's widget for tabbed login/register was not properly escaped and could be used in an XSS attack which could lead to wp-admin access. Further, the plugin in several places assigned $_POST as $_GET which meant that in some cases this could be replicated with just $_GET parameters and no need for $_POST values.
PLUGIN
Before 3
CVE-2021-24522
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2021-24507 - Before 3 Plugin
The Astra Pro Addon WordPress plugin before 3.5.2 did not properly sanitise or escape some of the POST parameters from the astra_pagination_infinite and astra_shop_pagination_infinite AJAX action (available to both unauthenticated and authenticated user) before using them in SQL statement, leading to an SQL Injection issues
PLUGIN
Before 3
CVE-2021-24507
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2021-24467 - Before 3 Plugin
The Leaflet Map WordPress plugin before 3.0.0 does not verify the CSRF nonce when saving its settings, which allows attackers to make a logged in admin update the settings via a Cross-Site Request Forgery attack. This could lead to Cross-Site Scripting issues by either changing the URL of the JavaScript library being used, or using malicious attributions which will be executed in all page with an embed map from the plugin
PLUGIN
Before 3
CVE-2021-24467
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2021-24472 - Before 3 Theme
The OnAir2 WordPress theme before 3.9.9.2 and QT KenthaRadio WordPress plugin before 2.0.2 have exposed proxy functionality to unauthenticated users, sending requests to this proxy functionality will have the web server fetch and display the content from any URI, this would allow for SSRF (Server Side Request Forgery) and RFI (Remote File Inclusion) vulnerabilities on the website.
THEME
Before 3
CVE-2021-24472
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2021-24483 - Before 3 Plugin
The get_poll_categories(), get_polls() and get_reports() functions in the Poll Maker WordPress plugin before 3.2.1 did not use whitelist or validate the orderby parameter before using it in SQL statements passed to the get_results() DB calls, leading to SQL injection issues in the admin dashboard
PLUGIN
Before 3
CVE-2021-24483
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2021-24470 - Before 3 Plugin
The Yada Wiki WordPress plugin before 3.4.1 did not sanitise, validate or escape the anchor attribute of its shortcode, leading to a Stored Cross-Site Scripting issue
PLUGIN
Before 3
CVE-2021-24470
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2021-24460 - Before 3 Plugin
The get_fb_likeboxes() function in the Popup Like box – Page Plugin WordPress plugin before 3.5.3 did not use whitelist or validate the orderby parameter before using it in SQL statements passed to the get_results() DB calls, leading to SQL injection issues in the admin dashboard
PLUGIN
Before 3
CVE-2021-24460
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2021-24468 - Before 3 Plugin
The Leaflet Map WordPress plugin before 3.0.0 does not escape some shortcode attributes before they are used in JavaScript code or HTML, which could allow users with a role as low as Contributors to exploit stored XSS issues
PLUGIN
Before 3
CVE-2021-24468
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2021-24450 - Before 3 Plugin
The User Registration, User Profiles, Login & Membership – ProfilePress (Formerly WP User Avatar) WordPress plugin before 3.1.8 did not sanitise or escape some of its settings before saving them and outputting them back in the page, allowing high privilege users such as admin to set JavaScript payloads in them even when the unfiltered_html capability is disallowed, leading to an authenticated Stored Cross-Site Scripting issue
PLUGIN
Before 3
CVE-2021-24450
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2021-24448 - Before 3 Plugin
The User Registration & User Profile – Profile Builder WordPress plugin before 3.4.8 does not sanitise or escape its 'Modify default Redirect Delay timer' setting, allowing high privilege users to use JavaScript code in it, even when the unfiltered_html capability is disallowed, leading to an authenticated Stored Cross-Site Scripting issue
PLUGIN
Before 3
CVE-2021-24448
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2021-24444 - Before 3 Plugin
The TaxoPress – Create and Manage Taxonomies, Tags, Categories WordPress plugin before 3.0.7.2 does not sanitise its Taxonomy description field, allowing high privilege users to set JavaScript payload in them even when the unfiltered_html capability is disallowed, leading to an authenticated Stored Cross-Site Scripting issue.
PLUGIN
Before 3
CVE-2021-24444
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2021-24375 - Before 3 Theme
Lack of authentication or validation in motor_load_more, motor_gallery_load_more, motor_quick_view and motor_project_quick_view AJAX handlers of the Motor WordPress theme before 3.1.0 allows an unauthenticated attacker access to arbitrary files in the server file system, and to execute arbitrary php scripts found on the server file system. We found no vulnerability for uploading files with this theme, so any scripts to be executed must already be on the server file system.
THEME
Before 3
CVE-2021-24375
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2021-24387 - Before 3 Theme
The WP Pro Real Estate 7 WordPress theme before 3.1.1 did not properly sanitise the ct_community parameter in its search listing page before outputting it back in it, leading to a reflected Cross-Site Scripting which can be triggered in both unauthenticated or authenticated user context
THEME
Before 3
CVE-2021-24387
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2021-24386 - Before 3 Plugin
The WP SVG images WordPress plugin before 3.4 did not sanitise the SVG files uploaded, which could allow low privilege users such as author+ to upload a malicious SVG and then perform XSS attacks by inducing another user to access the file directly. In v3.4, the plugin restricted such upload to editors and admin, with an option to also allow author to do so. The description of the plugin has also been updated with a security warning as upload of such content is intended.
PLUGIN
Before 3
CVE-2021-24386
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2021-24348 - Before 3 Plugin
The menu delete functionality of the Side Menu – add fixed side buttons WordPress plugin before 3.1.5, available to Administrator users takes the did GET parameter and uses it into an SQL statement without proper sanitisation, validation or escaping, therefore leading to a SQL Injection issue
PLUGIN
Before 3
CVE-2021-24348
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2021-24309 - Before 3 Plugin
The "Schedule Name" input in the Weekly Schedule WordPress plugin before 3.4.3 general options did not properly sanitize input, allowing a user to inject javascript code using the HTML tags and cause a stored XSS issue
PLUGIN
Before 3
CVE-2021-24309
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2021-24296 - Before 3 Plugin
The WP Customer Reviews WordPress plugin before 3.5.6 did not sanitise some of its settings, allowing high privilege users such as administrators to set XSS payloads in them which will then be triggered in pages where reviews are enabled
PLUGIN
Before 3
CVE-2021-24296
Risk Score