Live Vulnerability Intelligence
Threat Database
Search CVEs, inspect descriptions, and open detail pages with AI-assisted technical context.
Threat Entry
Updated 2024-11-21
CVE-2021-24608 - Changeset Plugin
The Formidable Form Builder – Contact Form, Survey & Quiz Forms Plugin for WordPress plugin before 5.0.07 does not sanitise and escape its Form's Labels, allowing high privileged users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed
PLUGIN
Changeset
CVE-2021-24608
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2021-39352 - Changeset Plugin
The Catch Themes Demo Import WordPress plugin is vulnerable to arbitrary file uploads via the import functionality found in the ~/inc/CatchThemesDemoImport.php file, in versions up to and including 1.7, due to insufficient file type validation. This makes it possible for an attacker with administrative privileges to upload malicious files that can be used to achieve remote code execution.
PLUGIN
Changeset
CVE-2021-39352
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2021-39357 - Changeset Plugin
The Leaky Paywall WordPress plugin is vulnerable to Stored Cross-Site Scripting due to insufficient input validation and sanitization via the ~/class.php file which allowed attackers with administrative user access to inject arbitrary web scripts, in versions up to and including 4.16.5. This affects multi-site installations where unfiltered_html is disabled for administrators, and sites where unfiltered_html is disabled.
PLUGIN
Changeset
CVE-2021-39357
Risk Score
Threat Entry
Updated 2025-02-07
CVE-2021-39354 - Changeset Plugin
The Easy Digital Downloads WordPress plugin is vulnerable to Reflected Cross-Site Scripting via the $start_date and $end_date parameters found in the ~/includes/admin/payments/class-payments-table.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 2.11.2.
PLUGIN
Changeset
CVE-2021-39354
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2021-39321 - Changeset Plugin
Version 3.3.23 of the Sassy Social Share WordPress plugin is vulnerable to PHP Object Injection via the wp_ajax_heateor_sss_import_config AJAX action due to deserialization of unvalidated user supplied inputs via the import_config function found in the ~/admin/class-sassy-social-share-admin.php file. This can be exploited by underprivileged authenticated users due to a missing capability check on the import_config function.
PLUGIN
Changeset
CVE-2021-39321
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2021-39328 - Changeset Plugin
The Simple Job Board WordPress plugin is vulnerable to Stored Cross-Site Scripting due to insufficient escaping on the $job_board_privacy_policy_label variable echo'd out via the ~/admin/settings/class-simple-job-board-settings-privacy.php file which allowed attackers with administrative user access to inject arbitrary web scripts, in versions up to and including 2.9.4. This affects multi-site installations where unfiltered_html is disabled for administrators, and sites where unfiltered_html is disabled.
PLUGIN
Changeset
CVE-2021-39328
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2021-39349 - Changeset Plugin
The Author Bio Box WordPress plugin is vulnerable to Stored Cross-Site Scripting due to insufficient input validation and sanitization via several parameters found in the ~/includes/admin/class-author-bio-box-admin.php file which allowed attackers with administrative user access to inject arbitrary web scripts, in versions up to and including 3.3.1. This affects multi-site installations where unfiltered_html is disabled for administrators, and sites where unfiltered_html is disabled.
PLUGIN
Changeset
CVE-2021-39349
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2021-39317 - Changeset Plugin
A WordPress plugin and several WordPress themes developed by AccessPress Themes are vulnerable to malicious file uploads via the plugin_offline_installer AJAX action due to a missing capability check in the plugin_offline_installer_callback function found in the /demo-functions.php file or /welcome.php file of the affected products. The complete list of affected products and their versions are below: WordPress Plugin: AccessPress Demo Importer
PLUGIN
Changeset
CVE-2021-39317
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2021-24720 - Changeset Plugin
The GeoDirectory Business Directory WordPress plugin before 2.1.1.3 was vulnerable to Authenticated Stored Cross-Site Scripting (XSS).
PLUGIN
Changeset
CVE-2021-24720
Risk Score
Threat Entry
Updated 2025-02-14
CVE-2021-39350 - Changeset Plugin
The FV Flowplayer Video Player WordPress plugin is vulnerable to Reflected Cross-Site Scripting via the player_id parameter found in the ~/view/stats.php file which allows attackers to inject arbitrary web scripts, in versions 7.5.0.727 - 7.5.2.727.
PLUGIN
Changeset
CVE-2021-39350
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2021-39347 - Changeset Plugin
The Stripe for WooCommerce WordPress plugin is missing a capability check on the save() function found in the ~/includes/admin/class-wc-stripe-admin-user-edit.php file that makes it possible for attackers to configure their account to use other site users unique STRIPE identifier and make purchases with their payment accounts. This affects versions 3.0.0 - 3.3.9.
PLUGIN
Changeset
CVE-2021-39347
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2021-39342 - Changeset Plugin
The Credova_Financial WordPress plugin discloses a site's associated Credova API account username and password in plaintext via an AJAX action whenever a site user goes to checkout on a page that has the Credova Financing option enabled. This affects versions up to, and including, 1.4.8.
PLUGIN
Changeset
CVE-2021-39342
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2021-34636 - Changeset Plugin
The Countdown and CountUp, WooCommerce Sales Timers WordPress plugin is vulnerable to Cross-Site Request Forgery via the save_theme function found in the ~/includes/admin/coundown_theme_page.php file due to a missing nonce check which allows attackers to inject arbitrary web scripts, in versions up to and including 1.5.7.
PLUGIN
Changeset
CVE-2021-34636
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2021-24728 - Changeset Plugin
The Membership & Content Restriction – Paid Member Subscriptions WordPress plugin before 2.4.2 did not sanitise, validate or escape its order and orderby parameters before using them in SQL statement, leading to Authenticated SQL Injections in the Members and Payments pages.
PLUGIN
Changeset
CVE-2021-24728
Risk Score
Threat Entry
Updated 2026-01-16
CVE-2021-24727 - Changeset Plugin
The StopBadBots WordPress plugin before 6.60 did not validate or escape the order and orderby GET parameter in some of its admin dashboard pages, leading to Authenticated SQL Injections
PLUGIN
Changeset
CVE-2021-24727
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2021-24724 - Changeset Plugin
The Timetable and Event Schedule by MotoPress WordPress plugin before 2.3.19 does not sanitise some of its parameters, which could allow low privilege users such as author to perform XSS attacks against frontend and backend users when viewing the related event/s
PLUGIN
Changeset
CVE-2021-24724
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2021-24565 - Changeset Plugin
The Contact Form 7 Captcha WordPress plugin before 0.0.9 does not have any CSRF check in place when saving its settings, allowing attacker to make a logged in user with the manage_options change them. Furthermore, the settings are not escaped when output in attributes, leading to a Stored Cross-Site Scripting issue.
PLUGIN
Changeset
CVE-2021-24565
Risk Score
Threat Entry
Updated 2024-12-17
CVE-2021-24561 - Changeset Plugin
The WP SMS WordPress plugin before 5.4.13 does not sanitise the "wp_group_name" parameter before outputting it back in the "Groups" page, leading to an Authenticated Stored Cross-Site Scripting issue
PLUGIN
Changeset
CVE-2021-24561
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2021-24658 - Changeset Plugin
The Erident Custom Login and Dashboard WordPress plugin before 3.5.9 did not properly sanitise its settings, allowing high privilege users to use XSS payloads in them (even when the unfileted_html is disabled)
PLUGIN
Changeset
CVE-2021-24658
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2021-24574 - Changeset Plugin
The Simple Banner WordPress plugin before 2.10.4 does not sanitise and escape one of its settings, allowing high privilege users such as admin to use Cross-Site Scripting payload even when the unfiltered_html capability is disallowed.
PLUGIN
Changeset
CVE-2021-24574
Risk Score