Live Vulnerability Intelligence
Threat Database
Search CVEs, inspect descriptions, and open detail pages with AI-assisted technical context.
Threat Entry
Updated 2024-11-21
CVE-2021-24403 - Wpagecontact Plugin
The Orders functionality in the WordPress Page Contact plugin through 1.0 has an order_id parameter which is not sanitised, escaped or validated before inserting to a SQL statement, leading to SQL injection. The feature is available to low privilege users such as contributors
PLUGIN
Wpagecontact
CVE-2021-24403
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2021-24402 - Wp Icommerce Plugin
The Orders functionality in the WP iCommerce WordPress plugin through 1.1.1 has an `order_id` parameter which is not sanitised, escaped or validated before inserting to a SQL statement, leading to SQL injection. The feature is available to low privilege users such as contributors
PLUGIN
Wp Icommerce
CVE-2021-24402
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2021-24401 - Wp Domain Redirect Plugin
The Edit domain functionality in the WP Domain Redirect WordPress plugin through 1.0 has an `editid` parameter which is not sanitised, escaped or validated before inserting to a SQL statement, leading to SQL injection.
PLUGIN
Wp Domain Redirect
CVE-2021-24401
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2021-24400 - Wp Display Users Plugin
The Edit Role functionality in the Display Users WordPress plugin through 2.0.0 had an `id` parameter which is not sanitised, escaped or validated before inserting to a SQL statement, leading to SQL injection.
PLUGIN
Wp Display Users
CVE-2021-24400
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2021-24585 - Timetable And Event Schedule Plugin
The Timetable and Event Schedule WordPress plugin before 2.4.0 outputs the Hashed Password, Username and Email Address (along other less sensitive data) of the user related to the Even Head of the Timeslot in the response when requesting the event Timeslot data with a user with the edit_posts capability. Combined with the other Unauthorised Event Timeslot Modification issue (https://wpscan.com/reports/submissions/4699/) where an arbitrary user ID can be set, this could allow low privilege users with the edit_posts capability (such as author) to retrieve sensitive User data by iterating over the user_id
PLUGIN
Timetable And Event Schedule
CVE-2021-24585
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2021-24597 - You Shang Plugin
The You Shang WordPress plugin through 1.0.1 does not escape its qrcode links settings, which result into Stored Cross-Site Scripting issues in frontend posts and the plugins settings page depending on the payload used
PLUGIN
You Shang
CVE-2021-24597
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2021-24587 - Splash Header Plugin
The Splash Header WordPress plugin before 1.20.8 doesn't sanitise and escape some of its settings while outputting them in the admin dashboard, leading to an authenticated Stored Cross-Site Scripting issue.
PLUGIN
Splash Header
CVE-2021-24587
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2021-24584 - Timetable And Event Schedule Plugin
The Timetable and Event Schedule WordPress plugin before 2.4.2 does not have proper access control when updating a timeslot, allowing any user with the edit_posts capability (contributor+) to update arbitrary timeslot from any events. Furthermore, no CSRF check is in place as well, allowing such attack to be perform via CSRF against a logged in with such capability. In versions before 2.3.19, the lack of sanitisation and escaping in some of the fields, like the descritption could also lead to Stored XSS issues
PLUGIN
Timetable And Event Schedule
CVE-2021-24584
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2021-24582 - Before 1 Plugin
The ThinkTwit WordPress plugin before 1.7.1 did not sanitise or escape its "Consumer key" setting before outputting it its settings page, leading to a Stored Cross-Site Scripting issue.
PLUGIN
Before 1
CVE-2021-24582
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2021-24525 - Shortcodes Ultimate Plugin
The Shortcodes Ultimate WordPress plugin before 5.10.2 allows users with Contributor roles to perform stored XSS via shortcode attributes. Note: the plugin is inconsistent in its handling of shortcode attributes; some do escape, most don't, and there are even some attributes that are insecure by design (like [su_button]'s onclick attribute).
PLUGIN
Shortcodes Ultimate
CVE-2021-24525
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2021-24609 - Wp Mapa Politico Espana Plugin
The WP Mapa Politico Espana WordPress plugin before 3.7.0 does not sanitise or escape some of its settings before outputting them in attributes, allowing high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html is disallowed
PLUGIN
Wp Mapa Politico Espana
CVE-2021-24609
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2021-24604 - Availability Calendar Plugin
The Availability Calendar WordPress plugin before 1.2.2 does not sanitise or escape its Category Names before outputting them in page/post where the associated shortcode is embed, allowing high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html is disallowed
PLUGIN
Availability Calendar
CVE-2021-24604
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2021-24600 - Wp Dialog Plugin
The WP Dialog WordPress plugin through 1.2.5.5 does not sanitise and escape some of its settings before outputting them in pages, allowing high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed.
PLUGIN
Wp Dialog
CVE-2021-24600
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2021-24596 - Youforms Free For Copecart Plugin
The youForms for WordPress plugin through 1.0.5 does not sanitise escape the Button Text field of its Templates, allowing high privilege users (editors and admins) to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed
PLUGIN
Youforms Free For Copecart
CVE-2021-24596
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2021-24530 - Alojapro Widget Plugin
The Alojapro Widget WordPress plugin through 1.1.15 doesn't properly sanitise its Custom CSS settings, allowing high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed
PLUGIN
Alojapro Widget
CVE-2021-24530
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2021-24583 - Timetable And Event Schedule Plugin
The Timetable and Event Schedule WordPress plugin before 2.4.2 does not have proper access control when deleting a timeslot, allowing any user with the edit_posts capability (contributor+) to delete arbitrary timeslot from any events. Furthermore, no CSRF check is in place as well, allowing such attack to be performed via CSRF against a logged in with such capability
PLUGIN
Timetable And Event Schedule
CVE-2021-24583
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2021-24399 - Sorter Plugin
The check_order function of The Sorter WordPress plugin through 1.0 uses an `area_id` parameter which is not sanitised, escaped or validated before inserting to a SQL statement, leading to SQL injection.
PLUGIN
Sorter
CVE-2021-24399
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2021-24398 - Responsive 3d Slider Plugin
The Add new scene functionality in the Responsive 3D Slider WordPress plugin through 1.2 uses an id parameter which is not sanitised, escaped or validated before being inserted to a SQL statement, leading to SQL injection. This is a time based SQLI and in the same function vulnerable parameter is passed twice so if we pass time as 5 seconds it takes 10 seconds to return since the query is ran twice.
PLUGIN
Responsive 3d Slider
CVE-2021-24398
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2021-24397 - Microcopy Plugin
The edit functionality in the MicroCopy WordPress plugin through 1.1.0 makes a get request to fetch the related option. The id parameter used is not sanitised, escaped or validated before inserting to a SQL statement, leading to SQL injection.
PLUGIN
Microcopy
CVE-2021-24397
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2021-24396 - Gseor Plugin
A pageid GET parameter of the GSEOR – WordPress SEO Plugin WordPress plugin through 1.3 is not sanitised, escaped or validated before inserting to a SQL statement, leading to SQL injection.
PLUGIN
Gseor
CVE-2021-24396
Risk Score