Live Vulnerability Intelligence
Threat Database
Search CVEs, inspect descriptions, and open detail pages with AI-assisted technical context.
Threat Entry
Updated 2024-11-21
CVE-2021-24387 - Real Estate 7 Plugin
The WP Pro Real Estate 7 WordPress theme before 3.1.1 did not properly sanitise the ct_community parameter in its search listing page before outputting it back in it, leading to a reflected Cross-Site Scripting which can be triggered in both unauthenticated or authenticated user context
PLUGIN
Real Estate 7
CVE-2021-24387
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2021-24388 - In The Vikrentcar Car Rental Management System Plugin
In the VikRentCar Car Rental Management System WordPress plugin before 1.1.7, there is a custom filed option by which we can manage all the fields that the users will have to fill in before saving the order. However, the field name is not sanitised or escaped before being output back in the page, leading to a stored Cross-Site Scripting issue. There is also no CSRF check done before saving the setting, allowing attackers to make a logged in admin set arbitrary Custom Fields, including one with XSS payload in it.
PLUGIN
In The Vikrentcar Car Rental Management System
CVE-2021-24388
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2021-24386 - Wp Svg Images Plugin
The WP SVG images WordPress plugin before 3.4 did not sanitise the SVG files uploaded, which could allow low privilege users such as author+ to upload a malicious SVG and then perform XSS attacks by inducing another user to access the file directly. In v3.4, the plugin restricted such upload to editors and admin, with an option to also allow author to do so. The description of the plugin has also been updated with a security warning as upload of such content is intended.
PLUGIN
Wp Svg Images
CVE-2021-24386
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2021-20746 - Wordpress Popular Posts Plugin
Cross-site scripting vulnerability in WordPress Popular Posts 5.3.2 and earlier allows a remote authenticated attacker to inject an arbitrary script via unspecified vectors.
PLUGIN
Wordpress Popular Posts
CVE-2021-20746
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2021-24376 - Before 2 Plugin
The Autoptimize WordPress plugin before 2.7.8 attempts to delete malicious files (such as .php) form the uploaded archive via the "Import Settings" feature, after its extraction. However, the extracted folders are not checked and it is possible to upload a zip which contained a directory with PHP file in it and then it is not removed from the disk. It is a bypass of CVE-2020-24948 which allows sending a PHP file via the "Import Settings" functionality to achieve Remote Code Execution.
PLUGIN
Before 2
CVE-2021-24376
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2021-24377 - Before 2 Plugin
The Autoptimize WordPress plugin before 2.7.8 attempts to remove potential malicious files from the extracted archive uploaded via the 'Import Settings' feature, however this is not sufficient to protect against RCE as a race condition can be achieved in between the moment the file is extracted on the disk but not yet removed. It is a bypass of CVE-2020-24948.
PLUGIN
Before 2
CVE-2021-24377
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2021-24383 - Wp Google Maps Plugin
The WP Google Maps WordPress plugin before 8.1.12 did not sanitise, validate of escape the Map Name when output in the Map List of the admin dashboard, leading to an authenticated Stored Cross-Site Scripting issue
PLUGIN
Wp Google Maps
CVE-2021-24383
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2021-24379 - Comments Like Dislike Plugin
The Comments Like Dislike WordPress plugin before 1.1.4 allows users to like/dislike posted comments, however does not prevent them from replaying the AJAX request to add a like. This allows any user (even unauthenticated) to add unlimited like/dislike to any comment. The plugin appears to have some Restriction modes, such as Cookie Restriction, IP Restrictions, Logged In User Restriction, however, they do not prevent such attack as they only check client side
PLUGIN
Comments Like Dislike
CVE-2021-24379
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2021-24378 - Before 2 Plugin
The Autoptimize WordPress plugin before 2.7.8 does not check for malicious files such as .html in the archive uploaded via the 'Import Settings' feature. As a result, it is possible for a high privilege user to upload a malicious file containing JavaScript code inside an archive which will execute when a victim visits index.html inside the plugin directory.
PLUGIN
Before 2
CVE-2021-24378
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2021-24370 - Fancy Product Designer Plugin
The Fancy Product Designer WordPress plugin before 4.6.9 allows unauthenticated attackers to upload arbitrary files, resulting in remote code execution.
PLUGIN
Fancy Product Designer
CVE-2021-24370
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2021-24361 - In The Location Manager Plugin
In the Location Manager WordPress plugin before 2.1.0.10, the AJAX action gd_popular_location_list did not properly sanitise or validate some of its POST parameters, which are then used in a SQL statement, leading to unauthenticated SQL Injection issues.
PLUGIN
In The Location Manager
CVE-2021-24361
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2021-24373 - Fix Your Wordpress Security Plugin
The WP Hardening – Fix Your WordPress Security WordPress plugin before 1.2.2 did not sanitise or escape the historyvalue GET parameter before outputting it in a Javascript block, leading to a reflected Cross-Site Scripting issue.
PLUGIN
Fix Your Wordpress Security
CVE-2021-24373
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2021-24372 - Fix Your Wordpress Security Plugin
The WP Hardening – Fix Your WordPress Security WordPress plugin before 1.2.2 did not sanitise or escape the $_SERVER['REQUEST_URI'] before outputting it in an attribute, leading to a reflected Cross-Site Scripting issue.
PLUGIN
Fix Your Wordpress Security
CVE-2021-24372
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2021-24364 - Jannah Plugin
The Jannah WordPress theme before 5.4.4 did not properly sanitize the options JSON parameter in its tie_get_user_weather AJAX action before outputting it back in the page, leading to a Reflected Cross-Site Scripting (XSS) vulnerability.
PLUGIN
Jannah
CVE-2021-24364
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2021-24369 - In The Getpaid Plugin
In the GetPaid WordPress plugin before 2.3.4, users with the contributor role and above can create a new Payment Form, however the Label and Help Text input fields were not getting sanitized properly. So it was possible to inject malicious content such as img tags, leading to a Stored Cross-Site Scripting issue which is triggered when the form will be edited, for example when an admin reviews it and could lead to privilege escalation.
PLUGIN
In The Getpaid
CVE-2021-24369
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2021-24367 - Wp Config File Editor Plugin
The WP Config File Editor WordPress plugin through 1.7.1 was affected by an Authenticated Stored Cross-Site Scripting (XSS) vulnerability.
PLUGIN
Wp Config File Editor
CVE-2021-24367
Risk Score
Threat Entry
Updated 2025-05-05
CVE-2021-24366 - Admin Columns Plugin
The Admin Columns WordPress plugin before 4.3 and Admin Columns Pro WordPress plugin before 5.5.1 do not sanitise and escape its Label settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
PLUGIN
Admin Columns
CVE-2021-24366
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2021-24339 - Custom Content Types And Fields Plugin
The Pods – Custom Content Types and Fields WordPress plugin before 2.7.27 was vulnerable to an Authenticated Stored Cross-Site Scripting (XSS) security vulnerability within the 'Menu Label' field parameter.
PLUGIN
Custom Content Types And Fields
CVE-2021-24339
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2021-24338 - Custom Content Types And Fields Plugin
The Pods – Custom Content Types and Fields WordPress plugin before 2.7.27 was vulnerable to an Authenticated Stored Cross-Site Scripting (XSS) security vulnerability within the 'Singular Label' field parameter.
PLUGIN
Custom Content Types And Fields
CVE-2021-24338
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2021-24374 - Jetpack Carousel Module Of The Jetpack Plugin
The Jetpack Carousel module of the JetPack WordPress plugin before 9.8 allows users to create a "carousel" type image gallery and allows users to comment on the images. A security vulnerability was found within the Jetpack Carousel module by nguyenhg_vcs that allowed the comments of non-published page/posts to be leaked.
PLUGIN
Jetpack Carousel Module Of The Jetpack
CVE-2021-24374
Risk Score