Live Vulnerability Intelligence
Threat Database
Search CVEs, inspect descriptions, and open detail pages with AI-assisted technical context.
Threat Entry
Updated 2024-11-21
CVE-2021-24450 - Before 3 Plugin
The User Registration, User Profiles, Login & Membership – ProfilePress (Formerly WP User Avatar) WordPress plugin before 3.1.8 did not sanitise or escape some of its settings before saving them and outputting them back in the page, allowing high privilege users such as admin to set JavaScript payloads in them even when the unfiltered_html capability is disallowed, leading to an authenticated Stored Cross-Site Scripting issue
PLUGIN
Before 3
CVE-2021-24450
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2021-24448 - Before 3 Plugin
The User Registration & User Profile – Profile Builder WordPress plugin before 3.4.8 does not sanitise or escape its 'Modify default Redirect Delay timer' setting, allowing high privilege users to use JavaScript code in it, even when the unfiltered_html capability is disallowed, leading to an authenticated Stored Cross-Site Scripting issue
PLUGIN
Before 3
CVE-2021-24448
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2021-24444 - Before 3 Plugin
The TaxoPress – Create and Manage Taxonomies, Tags, Categories WordPress plugin before 3.0.7.2 does not sanitise its Taxonomy description field, allowing high privilege users to set JavaScript payload in them even when the unfiltered_html capability is disallowed, leading to an authenticated Stored Cross-Site Scripting issue.
PLUGIN
Before 3
CVE-2021-24444
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2021-24375 - Before 3 Theme
Lack of authentication or validation in motor_load_more, motor_gallery_load_more, motor_quick_view and motor_project_quick_view AJAX handlers of the Motor WordPress theme before 3.1.0 allows an unauthenticated attacker access to arbitrary files in the server file system, and to execute arbitrary php scripts found on the server file system. We found no vulnerability for uploading files with this theme, so any scripts to be executed must already be on the server file system.
THEME
Before 3
CVE-2021-24375
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2021-24387 - Before 3 Theme
The WP Pro Real Estate 7 WordPress theme before 3.1.1 did not properly sanitise the ct_community parameter in its search listing page before outputting it back in it, leading to a reflected Cross-Site Scripting which can be triggered in both unauthenticated or authenticated user context
THEME
Before 3
CVE-2021-24387
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2021-24386 - Before 3 Plugin
The WP SVG images WordPress plugin before 3.4 did not sanitise the SVG files uploaded, which could allow low privilege users such as author+ to upload a malicious SVG and then perform XSS attacks by inducing another user to access the file directly. In v3.4, the plugin restricted such upload to editors and admin, with an option to also allow author to do so. The description of the plugin has also been updated with a security warning as upload of such content is intended.
PLUGIN
Before 3
CVE-2021-24386
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2021-24348 - Before 3 Plugin
The menu delete functionality of the Side Menu – add fixed side buttons WordPress plugin before 3.1.5, available to Administrator users takes the did GET parameter and uses it into an SQL statement without proper sanitisation, validation or escaping, therefore leading to a SQL Injection issue
PLUGIN
Before 3
CVE-2021-24348
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2021-24309 - Before 3 Plugin
The "Schedule Name" input in the Weekly Schedule WordPress plugin before 3.4.3 general options did not properly sanitize input, allowing a user to inject javascript code using the HTML tags and cause a stored XSS issue
PLUGIN
Before 3
CVE-2021-24309
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2021-24296 - Before 3 Plugin
The WP Customer Reviews WordPress plugin before 3.5.6 did not sanitise some of its settings, allowing high privilege users such as administrators to set XSS payloads in them which will then be triggered in pages where reviews are enabled
PLUGIN
Before 3
CVE-2021-24296
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2021-24188 - Before 3 Plugin
Low privileged users can use the AJAX action 'cp_plugins_do_button_job_later_callback' in the WP Content Copy Protection & No Right Click WordPress plugin before 3.1.5, to install any plugin (including a specific version) from the WordPress repository, as well as activate arbitrary plugin from then blog, which helps attackers install vulnerable plugins and could lead to more critical vulnerabilities like RCE.
PLUGIN
Before 3
CVE-2021-24188
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2021-24293 - Before 3 Plugin
In the eCommerce module of the NextGEN Gallery Pro WordPress plugin before 3.1.11, there is an action to call get_cart_items via photocrati_ajax , after that the settings[shipping_address][name] is able to inject malicious javascript.
PLUGIN
Before 3
CVE-2021-24293
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2021-24269 - Before 3 Plugin
The “Sina Extension for Elementor” WordPress Plugin before 3.3.12 has several widgets that are vulnerable to stored Cross-Site Scripting (XSS) by lower-privileged users such as contributors, all via a similar method.
PLUGIN
Before 3
CVE-2021-24269
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2021-24239 - Before 3 Plugin
The Pie Register – User Registration Forms. Invitation based registrations, Custom Login, Payments WordPress plugin before 3.7.0.1 does not sanitise the invitaion_code GET parameter when outputting it in the Activation Code page, leading to a reflected Cross-Site Scripting issue.
PLUGIN
Before 3
CVE-2021-24239
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2021-24218 - Before 3 Plugin
The wp_ajax_save_fbe_settings and wp_ajax_delete_fbe_settings AJAX actions of the Facebook for WordPress plugin before 3.0.4 were vulnerable to CSRF due to a lack of nonce protection. The settings in the saveFbeSettings function had no sanitization allowing for script tags to be saved.
PLUGIN
Before 3
CVE-2021-24218
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2021-24217 - Before 3 Plugin
The run_action function of the Facebook for WordPress plugin before 3.0.0 deserializes user supplied data making it possible for PHP objects to be supplied creating an Object Injection vulnerability. There was also a useable magic method in the plugin that could be used to achieve remote code execution.
PLUGIN
Before 3
CVE-2021-24217
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2021-24226 - Before 3 Plugin
In the AccessAlly WordPress plugin before 3.5.7, the file "resource/frontend/product/product-shortcode.php" responsible for the [accessally_order_form] shortcode is dumping serialize($_SERVER), which contains all environment variables. The leakage occurs on all public facing pages containing the [accessally_order_form] shortcode, no login or administrator role is required.
PLUGIN
Before 3
CVE-2021-24226
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2021-24200 - Before 3 Plugin
The wpDataTables – Tables & Table Charts premium WordPress plugin before 3.4.2 allows a low privilege authenticated user to perform Boolean-based blind SQL Injection in the table list page on the endpoint /wp-admin/admin-ajax.php?action=get_wdtable&table_id=1, on the 'length' HTTP POST parameter. This allows an attacker to access all the data in the database and obtain access to the WordPress application.
PLUGIN
Before 3
CVE-2021-24200
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2021-24198 - Before 3 Plugin
The wpDataTables – Tables & Table Charts premium WordPress plugin before 3.4.2 has Improper Access Control. A low privilege authenticated user that visits the page where the table is published can tamper the parameters to delete the data of another user that are present in the same table through id_key and id_val parameters. By exploiting this issue an attacker is able to delete the data of all users in the same table.
PLUGIN
Before 3
CVE-2021-24198
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2021-24197 - Before 3 Plugin
The wpDataTables – Tables & Table Charts premium WordPress plugin before 3.4.2 has Improper Access Control. A low privilege authenticated user that visits the page where the table is published can tamper the parameters to access the data of another user that are present in the same table by taking over the user permissions on the table through formdata[wdt_ID] parameter. By exploiting this issue an attacker is able to access and manage the data of all users in the same table.
PLUGIN
Before 3
CVE-2021-24197
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2021-24199 - Before 3 Plugin
The wpDataTables – Tables & Table Charts premium WordPress plugin before 3.4.2 allows a low privilege authenticated user to perform Boolean-based blind SQL Injection in the table list page on the endpoint /wp-admin/admin-ajax.php?action=get_wdtable&table_id=1, on the 'start' HTTP POST parameter. This allows an attacker to access all the data in the database and obtain access to the WordPress application.
PLUGIN
Before 3
CVE-2021-24199
Risk Score