Live Vulnerability Intelligence
Threat Database
Search CVEs, inspect descriptions, and open detail pages with AI-assisted technical context.
Threat Entry
Updated 2024-11-21
CVE-2021-24359 - Before 4 Plugin
The Plus Addons for Elementor Page Builder WordPress plugin before 4.1.11 did not properly check that a user requesting a password reset was the legitimate user, allowing an attacker to send an arbitrary reset password email to a registered user on behalf of the WordPress site. Such issue could be chained with an open redirect (CVE-2021-24358) in version below 4.1.10, to include a crafted password reset link in the email, which would lead to an account takeover.
PLUGIN
Before 4
CVE-2021-24359
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2021-24343 - Before 4 Plugin
The iFlyChat WordPress plugin before 4.7.0 does not sanitise its APP ID setting before outputting it back in the page, leading to an authenticated Stored Cross-Site Scripting issue
PLUGIN
Before 4
CVE-2021-24343
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2021-24335 - Before 4 Theme
The Car Repair Services & Auto Mechanic WordPress theme before 4.0 did not properly sanitise its serviceestimatekey search parameter before outputting it back in the page, leading to a reflected Cross-Site Scripting issue
THEME
Before 4
CVE-2021-24335
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2021-24334 - Before 4 Plugin
The Instant Images – One Click Unsplash Uploads WordPress plugin before 4.4.0.1 did not properly validate and sanitise its unsplash_download_w and unsplash_download_h parameter settings (/wp-admin/upload.php?page=instant-images), only validating them client side before saving them, leading to a Stored Cross-Site Scripting issue.
PLUGIN
Before 4
CVE-2021-24334
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2021-24294 - Before 4 Plugin
The dsgvoaio_write_log AJAX action of the DSGVO All in one for WP WordPress plugin before 4.0 did not sanitise or escape some POST parameter submitted before outputting them in the Log page in the administrator dashboard (wp-admin/admin.php?page=dsgvoaiofree-show-log). This could allow unauthenticated attackers to gain unauthorised access by using an XSS payload to create a rogue administrator account, which will be trigged when an administrator will view the logs.
PLUGIN
Before 4
CVE-2021-24294
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2021-24308 - Before 4 Plugin
The 'State' field of the Edit profile page of the LMS by LifterLMS – Online Course, Membership & Learning Management System Plugin for WordPress plugin before 4.21.1 is not properly sanitised when output in the About section of the profile page, leading to a stored Cross-Site Scripting issue. This could allow low privilege users (such as students) to elevate their privilege via an XSS attack when an admin will view their profile.
PLUGIN
Before 4
CVE-2021-24308
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2021-24244 - Before 4 Plugin
An AJAX action registered by the WPBakery Page Builder (Visual Composer) Clipboard WordPress plugin before 4.5.8 did not have capability checks, allowing low privilege users, such as subscribers, to update the license options (key, email).
PLUGIN
Before 4
CVE-2021-24244
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2021-24243 - Before 4 Plugin
An AJAX action registered by the WPBakery Page Builder (Visual Composer) Clipboard WordPress plugin before 4.5.6 did not have capability checks nor sanitization, allowing low privilege users (subscriber+) to call it and set XSS payloads, which will be triggered in all backend pages.
PLUGIN
Before 4
CVE-2021-24243
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2021-24257 - Before 4 Plugin
The “Premium Addons for Elementor” WordPress Plugin before 4.2.8 has several widgets that are vulnerable to stored Cross-Site Scripting (XSS) by lower-privileged users such as contributors, all via a similar method.
PLUGIN
Before 4
CVE-2021-24257
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2021-24255 - Before 4 Plugin
The Essential Addons for Elementor Lite WordPress Plugin before 4.5.4 has two widgets that are vulnerable to stored Cross-Site Scripting (XSS) by lower-privileged users such as contributors, both via a similar method.
PLUGIN
Before 4
CVE-2021-24255
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2021-24175 - Before 4 Plugin
The Plus Addons for Elementor Page Builder WordPress plugin before 4.1.7 was being actively exploited to by malicious actors to bypass authentication, allowing unauthenticated users to log in as any user (including admin) by just providing the related username, as well as create accounts with arbitrary roles, such as admin. These issues can be exploited even if registration is disabled, and the Login widget is not active.
PLUGIN
Before 4
CVE-2021-24175
Risk Score