Live Vulnerability Intelligence
Threat Database
Search CVEs, inspect descriptions, and open detail pages with AI-assisted technical context.
Threat Entry
Updated 2024-11-21
CVE-2021-25050 - Changeset Plugin
The Remove Footer Credit WordPress plugin before 1.0.11 does properly sanitise its settings, allowing high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html is disallowed.
PLUGIN
Changeset
CVE-2021-25050
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2022-0149 - Changeset Plugin
The WooCommerce Stored Exporter WordPress plugin before 2.7.1 was affected by a Reflected Cross-Site Scripting (XSS) vulnerability in the woo_ce admin page.
PLUGIN
Changeset
CVE-2022-0149
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2022-0148 - Changeset Plugin
The All-in-one Floating Contact Form, Call, Chat, and 50+ Social Icon Tabs WordPress plugin before 2.0.4 was vulnerable to reflected XSS on the my-sticky-elements-leads admin page.
PLUGIN
Changeset
CVE-2022-0148
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2021-25108 - Changeset Plugin
The IP2Location Country Blocker WordPress plugin before 2.26.6 does not have CSRF check in the ip2location_country_blocker_save_rules AJAX action, allowing attackers to make a logged in admin block arbitrary country, or block all of them at once, preventing users from accessing the frontend.
PLUGIN
Changeset
CVE-2021-25108
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2021-25096 - Changeset Plugin
The IP2Location Country Blocker WordPress plugin before 2.26.5 bans can be bypassed by using a specific parameter in the URL
PLUGIN
Changeset
CVE-2021-25096
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2021-25095 - Changeset Plugin
The IP2Location Country Blocker WordPress plugin before 2.26.5 does not have authorisation and CSRF checks in the ip2location_country_blocker_save_rules AJAX action, allowing any authenticated users, such as subscriber to call it and block arbitrary country, or block all of them at once, preventing users from accessing the frontend.
PLUGIN
Changeset
CVE-2021-25095
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2021-25077 - Changeset Plugin
The Store Toolkit for WooCommerce WordPress plugin before 2.3.2 does not sanitise and escape the tab parameter before outputting it back in an admin page in an error message, leading to a Reflected Cross-Site Scripting
PLUGIN
Changeset
CVE-2021-25077
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2021-24993 - Changeset Plugin
The Ultimate Product Catalog WordPress plugin before 5.0.26 does not have authorisation and CSRF checks in some AJAX actions, which could allow any authenticated users, such as subscriber to call them and add arbitrary products, or change the plugin's settings for example
PLUGIN
Changeset
CVE-2021-24993
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2022-0218 - Changeset Plugin
The WP HTML Mail WordPress plugin is vulnerable to unauthorized access which allows unauthenticated attackers to retrieve and modify theme settings due to a missing capability check on the /themesettings REST-API endpoint found in the ~/includes/class-template-designer.php file, in versions up to and including 3.0.9. This makes it possible for attackers with no privileges to execute the endpoint and add malicious JavaScript to a vulnerable WordPress site.
PLUGIN
Changeset
CVE-2022-0218
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2021-25085 - Changeset Plugin
The WOOF WordPress plugin before 1.2.6.3 does not sanitise and escape the woof_redraw_elements before outputing back in an admin page, leading to a Reflected Cross-Site Scripting
PLUGIN
Changeset
CVE-2021-25085
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2021-24975 - Changeset Plugin
The NextScripts: Social Networks Auto-Poster WordPress plugin before 4.3.24 does not sanitise and escape logged requests before outputting them in the related admin dashboard, leading to an Unauthenticated Stored Cross-Site Scripting issue
PLUGIN
Changeset
CVE-2021-24975
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2021-24919 - Changeset Plugin
The Wicked Folders WordPress plugin before 2.8.10 does not sanitise and escape the folder_id parameter before using it in a SQL statement in the wicked_folders_save_sort_order AJAX action, available to any authenticated user. leading to an SQL injection
PLUGIN
Changeset
CVE-2021-24919
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2021-24934 - Changeset Plugin
The Visual CSS Style Editor WordPress plugin before 7.5.4 does not sanitise and escape the wyp_page_type parameter before outputting it back in an admin page, leading to a Reflected Cross-Site Scripting issue
PLUGIN
Changeset
CVE-2021-24934
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2021-24648 - Changeset Plugin
The RegistrationMagic WordPress plugin before 5.0.1.9 does not sanitise and escape the rm_search_value parameter before outputting back in an attribute, leading to a Reflected Cross-Site Scripting
PLUGIN
Changeset
CVE-2021-24648
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2021-24686 - Changeset Plugin
The SVG Support WordPress plugin before 2.3.20 does not escape the "CSS Class to target" setting before outputting it in an attribute, which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed.
PLUGIN
Changeset
CVE-2021-24686
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2021-25076 - Changeset Plugin
The WP User Frontend WordPress plugin before 3.5.26 does not validate and escape the status parameter before using it in a SQL statement in the Subscribers dashboard, leading to an SQL injection. Due to the lack of sanitisation and escaping, this could also lead to Reflected Cross-Site Scripting
PLUGIN
Changeset
CVE-2021-25076
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2021-25073 - Changeset Plugin
The WP125 WordPress plugin before 1.5.5 does not have CSRF checks in various action, for example when deleting an ad, allowing attackers to make a logged in admin delete them via a CSRF attack
PLUGIN
Changeset
CVE-2021-25073
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2021-25045 - Changeset Plugin
The Asgaros Forum WordPress plugin before 1.15.15 does not validate or escape the forum_id parameter before using it in a SQL statement when editing a forum, leading to an SQL injection issue
PLUGIN
Changeset
CVE-2021-25045
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2021-25083 - Changeset Plugin
The Registrations for the Events Calendar WordPress plugin before 2.7.10 does not escape the qtype parameter before outputting it back in an attribute in the settings page, leading to a Reflected Cross-Site Scripting
PLUGIN
Changeset
CVE-2021-25083
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2021-25080 - Changeset Plugin
The Contact Form Entries WordPress plugin before 1.1.7 does not validate, sanitise and escape the IP address retrieved via headers such as CLIENT-IP and X-FORWARDED-FOR, allowing unauthenticated attackers to perform Cross-Site Scripting attacks against logged in admins viewing the created entry
PLUGIN
Changeset
CVE-2021-25080
Risk Score