sales@hackhalt.com
Free Download Free Download Free Download
Explore Pricing Explore Pricing Explore Pricing

Blog

"Prevention is cheaper than a breach"

Live Vulnerability Intelligence

Threat Database

Search CVEs, inspect descriptions, and open detail pages with AI-assisted technical context.

Total16,358
Critical1,021
High3,397
Medium11,667
Reset
Showing 15361-15380 of 16358 records
Threat Entry Updated 2024-11-21

CVE-2021-24764 - Perfect Survey Plugin

The Perfect Survey WordPress plugin before 1.5.2 does not sanitise and escape multiple parameters (id and filters[session_id] of single_statistics page, type and message of importexport page) before outputting them back in pages/attributes in the admin dashboard, leading to Reflected Cross-Site Scripting issues

PLUGIN Perfect Survey

CVE-2021-24764

MEDIUM CVSS 6.1 2022-02-01
Open Full Technical Breakdown
Threat Entry Updated 2024-11-21

CVE-2021-24648 - Before 5 Plugin

The RegistrationMagic WordPress plugin before 5.0.1.9 does not sanitise and escape the rm_search_value parameter before outputting back in an attribute, leading to a Reflected Cross-Site Scripting

PLUGIN Before 5

CVE-2021-24648

MEDIUM CVSS 6.1 2022-02-01
Open Full Technical Breakdown
Threat Entry Updated 2024-11-21

CVE-2021-24775 - Document Embedder Plugin

The Document Embedder WordPress plugin before 1.7.5 contains a REST endpoint, which could allow unauthenticated users to enumerate the title of arbitrary private and draft posts.

PLUGIN Document Embedder

CVE-2021-24775

MEDIUM CVSS 5.3 2022-02-01
Open Full Technical Breakdown
Threat Entry Updated 2024-11-21

CVE-2021-24900 - Ninja Tables Plugin

The Ninja Tables WordPress plugin before 4.1.8 does not sanitise and escape some of its table fields, which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed

PLUGIN Ninja Tables

CVE-2021-24900

MEDIUM CVSS 4.8 2022-02-01
Open Full Technical Breakdown
Threat Entry Updated 2024-11-21

CVE-2021-24707 - Learning Courses Plugin

The Learning Courses WordPress plugin before 5.0 does not sanitise and escape the Email PDT identity token settings, which could allow high privilege users to perform cross-Site Scripting attacks even when the unfiltered_html capability is disallowed

PLUGIN Learning Courses

CVE-2021-24707

MEDIUM CVSS 4.8 2022-02-01
Open Full Technical Breakdown
Threat Entry Updated 2024-11-21

CVE-2021-24686 - Before 2 Plugin

The SVG Support WordPress plugin before 2.3.20 does not escape the "CSS Class to target" setting before outputting it in an attribute, which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed.

PLUGIN Before 2

CVE-2021-24686

MEDIUM CVSS 4.8 2022-02-01
Open Full Technical Breakdown
Threat Entry Updated 2024-11-21

CVE-2021-24868 - Document Embedder Plugin

The Document Embedder WordPress plugin before 1.7.9 contains a AJAX action endpoint, which could allow any authenticated user, such as subscriber to enumerate the title of arbitrary private and draft posts.

PLUGIN Document Embedder

CVE-2021-24868

MEDIUM CVSS 4.3 2022-02-01
Open Full Technical Breakdown
Threat Entry Updated 2024-11-21

CVE-2021-25076 - Before 3 Plugin

The WP User Frontend WordPress plugin before 3.5.26 does not validate and escape the status parameter before using it in a SQL statement in the Subscribers dashboard, leading to an SQL injection. Due to the lack of sanitisation and escaping, this could also lead to Reflected Cross-Site Scripting

PLUGIN Before 3

CVE-2021-25076

HIGH CVSS 8.8 2022-01-24
Open Full Technical Breakdown
Threat Entry Updated 2024-11-21

CVE-2021-25073 - Before 1 Plugin

The WP125 WordPress plugin before 1.5.5 does not have CSRF checks in various action, for example when deleting an ad, allowing attackers to make a logged in admin delete them via a CSRF attack

PLUGIN Before 1

CVE-2021-25073

HIGH CVSS 8.8 2022-01-24
Open Full Technical Breakdown
Threat Entry Updated 2024-11-21

CVE-2021-25045 - Asgaros Forum Plugin

The Asgaros Forum WordPress plugin before 1.15.15 does not validate or escape the forum_id parameter before using it in a SQL statement when editing a forum, leading to an SQL injection issue

PLUGIN Asgaros Forum

CVE-2021-25045

HIGH CVSS 7.2 2022-01-24
Open Full Technical Breakdown
Threat Entry Updated 2024-11-21

CVE-2021-25013 - Before 1 Plugin

The Qubely WordPress plugin before 1.7.8 does not have authorisation and CSRF check on the qubely_delete_saved_block AJAX action, and does not ensure that the block to be deleted belong to the plugin, as a result, any authenticated users, such as subscriber can delete arbitrary posts

PLUGIN Before 1

CVE-2021-25013

MEDIUM CVSS 6.5 2022-01-24
Open Full Technical Breakdown
Threat Entry Updated 2024-11-21

CVE-2021-24989 - Accept Donations With Paypal Plugin

The Accept Donations with PayPal WordPress plugin before 1.3.4 does not have CSRF check in place and does not ensure that the post to be deleted belongs to the plugin, allowing attackers to make a logged in admin delete arbitrary posts from the blog

PLUGIN Accept Donations With Paypal

CVE-2021-24989

MEDIUM CVSS 6.5 2022-01-24
Open Full Technical Breakdown
Threat Entry Updated 2024-11-21

CVE-2021-25083 - Before 2 Plugin

The Registrations for the Events Calendar WordPress plugin before 2.7.10 does not escape the qtype parameter before outputting it back in an attribute in the settings page, leading to a Reflected Cross-Site Scripting

PLUGIN Before 2

CVE-2021-25083

MEDIUM CVSS 6.1 2022-01-24
Open Full Technical Breakdown
Threat Entry Updated 2024-11-21

CVE-2021-25080 - Before 1 Plugin

The Contact Form Entries WordPress plugin before 1.1.7 does not validate, sanitise and escape the IP address retrieved via headers such as CLIENT-IP and X-FORWARDED-FOR, allowing unauthenticated attackers to perform Cross-Site Scripting attacks against logged in admins viewing the created entry

PLUGIN Before 1

CVE-2021-25080

MEDIUM CVSS 6.1 2022-01-24
Open Full Technical Breakdown
Threat Entry Updated 2024-11-21

CVE-2021-25079 - Contact Form Entries Plugin

The Contact Form Entries WordPress plugin before 1.2.4 does not sanitise and escape various parameters, such as form_id, status, end_date, order, orderby and search before outputting them back in the admin page

PLUGIN Contact Form Entries

CVE-2021-25079

MEDIUM CVSS 6.1 2022-01-24
Open Full Technical Breakdown
Threat Entry Updated 2024-11-21

CVE-2021-25078 - Affiliates Manager Plugin

The Affiliates Manager WordPress plugin before 2.9.0 does not validate, sanitise and escape the IP address of requests logged by the click tracking feature, allowing unauthenticated attackers to perform Cross-Site Scripting attacks against admin viewing the tracked requests.

PLUGIN Affiliates Manager

CVE-2021-25078

MEDIUM CVSS 6.1 2022-01-24
Open Full Technical Breakdown
Scroll to top