Live Vulnerability Intelligence
Threat Database
Search CVEs, inspect descriptions, and open detail pages with AI-assisted technical context.
Threat Entry
Updated 2024-11-21
CVE-2021-24973 - Site Reviews Plugin
The Site Reviews WordPress plugin before 5.17.3 does not sanitise and escape the site-reviews parameter of the glsr_action AJAX action (available to unauthenticated and any authenticated users), allowing them to perform Cross-Site Scripting attacks against logged in admins viewing the Tool dashboard of the plugin
PLUGIN
Site Reviews
CVE-2021-24973
Risk Score
Threat Entry
Updated 2025-05-22
CVE-2021-24964 - Litespeed Cache Plugin
The LiteSpeed Cache WordPress plugin before 4.4.4 does not properly verify that requests are coming from QUIC.cloud servers, allowing attackers to make requests to certain endpoints by using a specific X-Forwarded-For header value. In addition, one of the endpoint could be used to set CSS code if a setting is enabled, which will then be output in some pages without being sanitised and escaped. Combining those two issues, an unauthenticated attacker could put Cross-Site Scripting payloads in pages visited by users.
PLUGIN
Litespeed Cache
CVE-2021-24964
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2021-24828 - Loan Calculator Plugin
The Mortgage Calculator / Loan Calculator WordPress plugin before 1.5.17 does not escape the some of the attributes of its mlcalc shortcode before outputting them, which could allow users with a role as low as contributor to perform Cross-Site Scripting attacks
PLUGIN
Loan Calculator
CVE-2021-24828
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2021-24680 - Wp Travel Engine Plugin
The WP Travel Engine WordPress plugin before 5.3.1 does not escape the Description field in the Trip Destination/Activities/Trip Type and Pricing Category pages, allowing users with a role as low as editor to perform Stored Cross-Site Scripting attacks, even when the unfiltered_html capability is disallowed
PLUGIN
Wp Travel Engine
CVE-2021-24680
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2021-25020 - Host Google Analytics Locally Plugin
The CAOS | Host Google Analytics Locally WordPress plugin before 4.1.9 does not validate the cache directory setting, allowing high privilege users to use a path traversal vector and delete arbitrary folders when uninstalling the plugin
PLUGIN
Host Google Analytics Locally
CVE-2021-25020
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2021-24991 - Packing Slips Plugin
The WooCommerce PDF Invoices & Packing Slips WordPress plugin before 2.10.5 does not escape the tab and section parameters before outputting it back in an attribute, leading to a Reflected Cross-Site Scripting in the admin dashboard
PLUGIN
Packing Slips
CVE-2021-24991
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2021-24963 - Before 4 Plugin
The LiteSpeed Cache WordPress plugin before 4.4.4 does not escape the qc_res parameter before outputting it back in the JS code of an admin page, leading to a Reflected Cross-Site Scripting
PLUGIN
Before 4
CVE-2021-24963
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2021-24998 - Before 3 Plugin
The Simple JWT Login WordPress plugin before 3.3.0 can be used to create new WordPress user accounts with a randomly generated password. The password is generated using the str_shuffle PHP function that "does not generate cryptographically secure values, and should not be used for cryptographic purposes" according to PHP's documentation.
PLUGIN
Before 3
CVE-2021-24998
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2021-24997 - Before 1 Plugin
The WP Guppy WordPress plugin before 1.3 does not have any authorisation in some of the REST API endpoints, allowing any user to call them and could lead to sensitive information disclosure, such as usernames and chats between users, as well as be able to send messages as an arbitrary user
PLUGIN
Before 1
CVE-2021-24997
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2021-24984 - Wpfront User Role Editor Plugin
The WPFront User Role Editor WordPress plugin before 3.2.1.11184 does not sanitise and escape the changes-saved parameter before outputting it back in the admin dashboard, leading to a Reflected Cross-Site Scripting
PLUGIN
Wpfront User Role Editor
CVE-2021-24984
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2021-24980 - Gwolle Guestbook Plugin
The Gwolle Guestbook WordPress plugin before 4.2.0 does not sanitise and escape the gwolle_gb_user_email parameter before outputting it back in an attribute, leading to a Reflected Cross-Site Scripting issue in an admin page
PLUGIN
Gwolle Guestbook
CVE-2021-24980
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2021-24979 - Paid Memberships Pro Plugin
The Paid Memberships Pro WordPress plugin before 2.6.6 does not escape the s parameter before outputting it back in an attribute in an admin page, leading to a Reflected Cross-Site Scripting
PLUGIN
Paid Memberships Pro
CVE-2021-24979
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2021-24967 - Lead Form Elementor Builder Plugin
The Contact Form & Lead Form Elementor Builder WordPress plugin before 1.6.4 does not sanitise and escape some lead values, which could allow unauthenticated users to perform Cross-Site Scripting attacks against logged in admin viewing the inserted Leads
PLUGIN
Lead Form Elementor Builder
CVE-2021-24967
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2021-24988 - Wp Rss Aggregator Plugin
The WP RSS Aggregator WordPress plugin before 4.19.3 does not sanitise and escape data before outputting it in the System Info admin dashboard, which could lead to a Stored XSS issue due to the wprss_dismiss_addon_notice AJAX action missing authorisation and CSRF checks, allowing any authenticated users, such as subscriber to call it and set a malicious payload in the addon parameter.
PLUGIN
Wp Rss Aggregator
CVE-2021-24988
Risk Score
Threat Entry
Updated 2025-03-21
CVE-2021-24969 - Wordpress Download Manager Plugin
The WordPress Download Manager WordPress plugin before 3.2.22 does not sanitise and escape Template data before outputting it in various pages (such as admin dashboard and frontend). Due to the lack of authorisation and CSRF checks in the wpdm_save_template AJAX action, any authenticated users such as subscriber is able to call it and perform Cross-Site Scripting attacks
PLUGIN
Wordpress Download Manager
CVE-2021-24969
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2021-24992 - Sticky Buttons Plugin
The Smart Floating / Sticky Buttons WordPress plugin before 2.5.5 does not sanitise and escape some parameter before outputting them in attributes and page, which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed.
PLUGIN
Sticky Buttons
CVE-2021-24992
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2021-24753 - Before 1 Plugin
The Rich Reviews by Starfish WordPress plugin before 1.9.6 does not properly validate the orderby GET parameter of the pending reviews page before using it in a SQL statement, leading to an authenticated SQL injection issue
PLUGIN
Before 1
CVE-2021-24753
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2021-24797 - Before 3 Plugin
The Tickera WordPress plugin before 3.4.8.3 does not properly sanitise and escape the Name fields of booked Events before outputting them in the Orders admin dashboard, which could allow unauthenticated users to perform Cross-Site Scripting attacks against admins.
PLUGIN
Before 3
CVE-2021-24797
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2021-24902 - Build Beautiful Conversational Forms Plugin
The Typebot | Build beautiful conversational forms WordPress plugin before 1.4.3 does not sanitise and escape the Publish ID setting, which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed.
PLUGIN
Build Beautiful Conversational Forms
CVE-2021-24902
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2021-36886 - Contact Form 7 Database Addon Plugin
Cross-Site Request Forgery (CSRF) vulnerability discovered in Contact Form 7 Database Addon – CFDB7 WordPress plugin (versions
PLUGIN
Contact Form 7 Database Addon
CVE-2021-36886
Risk Score