Live Vulnerability Intelligence
Threat Database
Search CVEs, inspect descriptions, and open detail pages with AI-assisted technical context.
Threat Entry
Updated 2024-11-21
CVE-2021-24595 - Wp Cookie Choice Plugin
The Wp Cookie Choice WordPress plugin through 1.1.0 is lacking any CSRF check when saving its options, and do not escape them when outputting them in attributes. As a result, an attacker could make a logged in admin change them to arbitrary values including XSS payloads via a CSRF attack.
PLUGIN
Wp Cookie Choice
CVE-2021-24595
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2021-24617 - Gamepress Plugin
The GamePress WordPress plugin through 1.1.0 does not escape the op_edit POST parameter before outputting it back in multiple Game Option pages, leading to Reflected Cross-Site Scripting issues
PLUGIN
Gamepress
CVE-2021-24617
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2021-24743 - Podcast Subscribe Buttons Plugin
The Podcast Subscribe Buttons WordPress plugin before 1.4.2 allows users with any role capable of editing or adding posts to perform stored XSS.
PLUGIN
Podcast Subscribe Buttons
CVE-2021-24743
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2021-24734 - Compact Wp Audio Player Plugin
The Compact WP Audio Player WordPress plugin before 1.9.7 does not escape some of its shortcodes attributes, which could allow users with a role as low as Contributor to perform Stored Cross-Site Scripting attacks.
PLUGIN
Compact Wp Audio Player
CVE-2021-24734
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2021-24732 - Before 1 Plugin
The PDF Flipbook, 3D Flipbook WordPress – DearFlip WordPress plugin before 1.7.10 does not escape the class attribute of its shortcode before outputting it back in an attribute, which could allow users with a role as low as Contributor to perform Stored Cross-Site Scripting attacks
PLUGIN
Before 1
CVE-2021-24732
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2021-24672 - One User Avatar Plugin
The One User Avatar WordPress plugin before 2.3.7 does not escape the link and target attributes of its shortcode, allowing users with a role as low as Contributor to perform Stored Cross-Site Scripting attacks
PLUGIN
One User Avatar
CVE-2021-24672
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2021-24615 - Wechat Reward Plugin
The Wechat Reward WordPress plugin through 1.7 does not sanitise or escape its QR settings, nor has any CSRF check in place, allowing attackers to make a logged in admin change the settings and perform Cross-Site Scripting attacks.
PLUGIN
Wechat Reward
CVE-2021-24615
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2021-24677 - Find My Blocks Plugin
The Find My Blocks WordPress plugin before 3.4.0 does not have authorisation checks in its REST API, which could allow unauthenticated users to enumerate private posts' titles.
PLUGIN
Find My Blocks
CVE-2021-24677
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2021-24740 - Before 1 Plugin
The Tutor LMS WordPress plugin before 1.9.9 does not escape some of its settings before outputting them in attributes, which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed.
PLUGIN
Before 1
CVE-2021-24740
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2021-24736 - Shared Files Plugin
The Easy Download Manager and File Sharing Plugin with frontend file upload – a better Media Library — Shared Files WordPress plugin before 1.6.57 does not sanitise and escape some of its settings before outputting them in attributes, which could lead to Stored Cross-Site Scripting issues.
PLUGIN
Shared Files
CVE-2021-24736
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2021-24702 - Before 4 Plugin
The LearnPress WordPress plugin before 4.1.3.1 does not properly sanitize or escape various inputs within course settings, which could allow high privilege users to perform Cross-Site Scripting attacks when the unfiltred_html capability is disallowed
PLUGIN
Before 4
CVE-2021-24702
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2021-24622 - Support Ticket System Plugin
The Customer Service Software & Support Ticket System WordPress plugin before 5.10.4 does not sanitize or escape form fields before outputting it in the List, which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed.
PLUGIN
Support Ticket System
CVE-2021-24622
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2021-24612 - Sociable Plugin
The Sociable WordPress plugin through 4.3.4.1 does not sanitise or escape some of its settings before outputting them in the admins dashboard, allowing high privilege users to perform Cross-Site Scripting attacks against other users even when the unfiltered_html capability is disallowed
PLUGIN
Sociable
CVE-2021-24612
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2021-24516 - Planso Forms Plugin
The PlanSo Forms WordPress plugin through 2.6.3 does not escape the title of its Form before outputting it in attributes, allowing high privilege users such as admin to set XSS payload in it, even when the unfiltered_html is disallowed, leading to an Authenticated Stored Cross-Site Scripting issue.
PLUGIN
Planso Forms
CVE-2021-24516
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2021-24416 - Radio Player For Plugin
The StreamCast – Radio Player for WordPress plugin before 2.1.1 does not sanitise or validate the parameters from its shortcode, allowing users with a role as low as contributor to set Cross-Site Scripting payload in them which will be triggered in the page/s with the embed malicious shortcode
PLUGIN
Radio Player For
CVE-2021-24416
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2021-24415 - Polo Video Gallery Plugin
The Polo Video Gallery – Best wordpress video gallery plugin WordPress plugin through 1.2 does not sanitise or validate the parameters from its shortcode, allowing users with a role as low as contributor to set Cross-Site Scripting payload in them which will be triggered in the page/s with the embed malicious shortcode
PLUGIN
Polo Video Gallery
CVE-2021-24415
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2021-24413 - Easy Twitter Feed Plugin
The Easy Twitter Feed WordPress plugin before 1.2 does not sanitise or validate the parameters from its shortcode, allowing users with a role as low as contributor to set Cross-Site Scripting payload in them which will be triggered in the page/s with the embed malicious shortcode
PLUGIN
Easy Twitter Feed
CVE-2021-24413
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2021-24412 - Audio Player For Plugin
The Html5 Audio Player – Audio Player for WordPress plugin before 2.1.3 does not sanitise or validate the parameters from its shortcode, allowing users with a role as low as contributor to set Cross-Site Scripting payload in them which will be triggered in the page/s with the embed malicious shortcode
PLUGIN
Audio Player For
CVE-2021-24412
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2021-39349 - Author Bio Box Plugin
The Author Bio Box WordPress plugin is vulnerable to Stored Cross-Site Scripting due to insufficient input validation and sanitization via several parameters found in the ~/includes/admin/class-author-bio-box-admin.php file which allowed attackers with administrative user access to inject arbitrary web scripts, in versions up to and including 3.3.1. This affects multi-site installations where unfiltered_html is disabled for administrators, and sites where unfiltered_html is disabled.
PLUGIN
Author Bio Box
CVE-2021-39349
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2021-39345 - Hal Plugin
The HAL WordPress plugin is vulnerable to Stored Cross-Site Scripting due to insufficient input validation and sanitization via several parameters found in the ~/wp-hal.php file which allowed attackers with administrative user access to inject arbitrary web scripts, in versions up to and including 2.1.1. This affects multi-site installations where unfiltered_html is disabled for administrators, and sites where unfiltered_html is disabled.
PLUGIN
Hal
CVE-2021-39345
Risk Score