Live Vulnerability Intelligence
Threat Database
Search CVEs, inspect descriptions, and open detail pages with AI-assisted technical context.
Threat Entry
Updated 2024-11-21
CVE-2021-24731 - Invitation Codes Plugin
The Registration Forms – User profile, Content Restriction, Spam Protection, Payment Gateways, Invitation Codes WordPress plugin before 3.7.1.6 does not properly escape user data before using it in a SQL statement in the wp-json/pie/v1/login REST API endpoint, leading to an SQL injection.
PLUGIN
Invitation Codes
CVE-2021-24731
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2021-24693 - Simple Download Monitor Plugin
The Simple Download Monitor WordPress plugin before 3.9.5 does not escape the "File Thumbnail" post meta before outputting it in some pages, which could allow users with a role as low as Contributor to perform Stored Cross-Site Scripting attacks. Given the that XSS is triggered even when the Download is in a review state, contributor could make JavaScript code execute in a context of a reviewer such as admin and make them create a rogue admin account, or install a malicious plugin
PLUGIN
Simple Download Monitor
CVE-2021-24693
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2021-24695 - Simple Download Monitor Plugin
The Simple Download Monitor WordPress plugin before 3.9.6 saves logs in a predictable location, and does not have any authentication or authorisation in place to prevent unauthenticated users to download and read the logs containing Sensitive Information such as IP Addresses and Usernames
PLUGIN
Simple Download Monitor
CVE-2021-24695
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2021-24791 - Header Footer Code Manager Plugin
The Header Footer Code Manager WordPress plugin before 1.1.14 does not validate and escape the "orderby" and "order" request parameters before using them in a SQL statement when viewing the Snippets admin dashboard, leading to SQL injections
PLUGIN
Header Footer Code Manager
CVE-2021-24791
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2021-24788 - Batch Cat Plugin
The Batch Cat WordPress plugin through 0.3 defines 3 custom AJAX actions, which both require authentication but are available for all roles. As a result, any authenticated user (including simple subscribers) can add/set/delete arbitrary categories to posts.
PLUGIN
Batch Cat
CVE-2021-24788
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2021-24783 - Post Expirator Plugin
The Post Expirator WordPress plugin before 2.6.0 does not have proper capability checks in place, which could allow users with a role as low as Contributor to schedule deletion of arbitrary posts.
PLUGIN
Post Expirator
CVE-2021-24783
Risk Score
Threat Entry
Updated 2026-01-23
CVE-2021-24767 - Redirect 404 Error Page To Homepage Or Custom Page With Logs Plugin
The Redirect 404 Error Page to Homepage or Custom Page with Logs WordPress plugin before 1.7.9 does not check for CSRF when deleting logs, which could allow attacker to make a logged in admin delete them via a CSRF attack
PLUGIN
Redirect 404 Error Page To Homepage Or Custom Page With Logs
CVE-2021-24767
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2021-24766 - Log And Notify 404 Errors Plugin
The 404 to 301 – Redirect, Log and Notify 404 Errors WordPress plugin before 3.0.9 does not have CSRF check in place when cleaning the logs, which could allow attacker to make a logged in admin delete all of them via a CSRF attack
PLUGIN
Log And Notify 404 Errors
CVE-2021-24766
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2021-24721 - Loco Translate Plugin
The Loco Translate WordPress plugin before 2.5.4 mishandles data inputs which get saved to a file, which can be renamed to an extension ending in .php, resulting in authenticated "translator" users being able to inject PHP code into files ending with .php in web accessible locations.
PLUGIN
Loco Translate
CVE-2021-24721
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2021-24798 - Wp Header Images Plugin
The WP Header Images WordPress plugin before 2.0.1 does not sanitise and escape the t parameter before outputting it back in the plugin's settings page, leading to a Reflected Cross-Site Scripting issue
PLUGIN
Wp Header Images
CVE-2021-24798
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2021-24697 - Simple Download Monitor Plugin
The Simple Download Monitor WordPress plugin before 3.9.5 does not escape the 1) sdm_active_tab GET parameter and 2) sdm_stats_start_date/sdm_stats_end_date POST parameters before outputting them back in attributes, leading to Reflected Cross-Site Scripting issues
PLUGIN
Simple Download Monitor
CVE-2021-24697
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2021-24710 - Print O Matic Plugin
The Print-O-Matic WordPress plugin before 2.0.3 does not escape some of its settings before outputting them in attribute, which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed.
PLUGIN
Print O Matic
CVE-2021-24710
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2021-24708 - Before 1 Plugin
The Export any WordPress data to XML/CSV WordPress plugin before 1.3.1 does not escape its Export's Name before outputting it in Manage Exports settings, which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed
PLUGIN
Before 1
CVE-2021-24708
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2021-24706 - Online Quizzes And Flashcards Plugin
The Qwizcards – online quizzes and flashcards WordPress plugin before 3.62 does not properly sanitize and escape some of its settings, allowing high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed.
PLUGIN
Online Quizzes And Flashcards
CVE-2021-24706
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2021-24701 - Quiz Tool Lite Plugin
The Quiz Tool Lite WordPress plugin through 2.3.15 does not sanitize multiple input fields used when creating or managing quizzes and in other setting options, allowing high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed.
PLUGIN
Quiz Tool Lite
CVE-2021-24701
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2021-24801 - Wp Survey Plus Plugin
The WP Survey Plus WordPress plugin through 1.0 does not have any authorisation and CSRF checks in place in its AJAX actions, allowing any user to call them and add/edit/delete Surveys. Furthermore, due to the lack of sanitization in the Surveys' Title, this could also lead to Stored Cross-Site Scripting issues
PLUGIN
Wp Survey Plus
CVE-2021-24801
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2021-24698 - Simple Download Monitor Plugin
The Simple Download Monitor WordPress plugin before 3.9.6 allows users with a role as low as Contributor to remove thumbnails from downloads they do not own, even if they cannot normally edit the download.
PLUGIN
Simple Download Monitor
CVE-2021-24698
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2021-24669 - Preloader Builder For Plugin
The MAZ Loader – Preloader Builder for WordPress plugin before 1.3.3 does not validate or escape the loader_id parameter of the mzldr shortcode, which allows users with a role as low as Contributor to perform SQL injection.
PLUGIN
Preloader Builder For
CVE-2021-24669
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2021-24631 - Unlimited Popups Plugin
The Unlimited PopUps WordPress plugin through 4.5.3 does not sanitise or escape the did GET parameter before using it in a SQL statement, available to users as low as editor, leading to an authenticated SQL Injection
PLUGIN
Unlimited Popups
CVE-2021-24631
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2021-24630 - Schreikasten Plugin
The Schreikasten WordPress plugin through 0.14.18 does not sanitise or escape the id GET parameter before using it in SQL statements in the comments dashboard from various actions, leading to authenticated SQL Injections which can be exploited by users as low as author
PLUGIN
Schreikasten
CVE-2021-24630
Risk Score