Live Vulnerability Intelligence
Threat Database
Search CVEs, inspect descriptions, and open detail pages with AI-assisted technical context.
Threat Entry
Updated 2024-11-21
CVE-2021-24209 - Before 1 Plugin
The WP Super Cache WordPress plugin before 1.7.2 was affected by an authenticated (admin+) RCE in the settings page due to input validation failure and weak $cache_path check in the WP Super Cache Settings -> Cache Location option. Direct access to the wp-cache-config.php file is not prohibited, so this vulnerability can be exploited for a web shell injection.
PLUGIN
Before 1
CVE-2021-24209
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2021-24210 - There Is An Open Redirect In The Phastpress Plugin
There is an open redirect in the PhastPress WordPress plugin before 1.111 that allows an attacker to malform a request to a page with the plugin and then redirect the victim to a malicious page. There is also a support comment from another user one year ago (https://wordpress.org/support/topic/phast-php-used-for-remote-fetch/) that says that the php involved in the request only go to whitelisted pages but it's possible to redirect the victim to any domain.
PLUGIN
There Is An Open Redirect In The Phastpress
CVE-2021-24210
Risk Score
Threat Entry
Updated 2025-08-12
CVE-2021-24211 - Wordpress Related Posts Plugin
The WordPress Related Posts plugin through 3.6.4 contains an authenticated (admin+) stored XSS vulnerability in the title field on the settings page. By exploiting that an attacker will be able to execute JavaScript code in the user's browser.
PLUGIN
Wordpress Related Posts
CVE-2021-24211
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2021-24208 - Editor Of The Wp Page Builder Plugin
The editor of the WP Page Builder WordPress plugin before 1.2.4 allows lower-privileged users to insert unfiltered HTML, including JavaScript, into pages via the “Raw HTML” widget and the “Custom HTML” widgets (though the custom HTML widget requires sending a crafted request - it appears that this widget uses some form of client side validation but not server side validation), all of which are added via the “page_builder_data” parameter when performing the “wppb_page_save” AJAX action. It is also possible to insert malicious JavaScript via the “wppb_page_css” parameter (this can be…
PLUGIN
Editor Of The Wp Page Builder
CVE-2021-24208
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2021-24206 - In The Elementor Website Builder Plugin
In the Elementor Website Builder WordPress plugin before 3.1.4, the image box widget (includes/widgets/image-box.php) accepts a ‘title_size’ parameter. Although the element control lists a fixed set of possible html tags, it is possible for a user with Contributor or above permissions to send a modified ‘save_builder’ request containing JavaScript in the ‘title_size’ parameter, which is not filtered and is output without escaping. This JavaScript will then be executed when the saved page is viewed or previewed.
PLUGIN
In The Elementor Website Builder
CVE-2021-24206
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2021-24205 - In The Elementor Website Builder Plugin
In the Elementor Website Builder WordPress plugin before 3.1.4, the icon box widget (includes/widgets/icon-box.php) accepts a ‘title_size’ parameter. Although the element control lists a fixed set of possible html tags, it is possible for a user with Contributor or above permissions to send a modified ‘save_builder’ request containing JavaScript in the ‘title_size’ parameter, which is not filtered and is output without escaping. This JavaScript will then be executed when the saved page is viewed or previewed.
PLUGIN
In The Elementor Website Builder
CVE-2021-24205
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2021-24204 - In The Elementor Website Builder Plugin
In the Elementor Website Builder WordPress plugin before 3.1.4, the accordion widget (includes/widgets/accordion.php) accepts a ‘title_html_tag’ parameter. Although the element control lists a fixed set of possible html tags, it is possible for a user with Contributor or above permissions to send a modified ‘save_builder’ request containing JavaScript in the ‘title_html_tag’ parameter, which is not filtered and is output without escaping. This JavaScript will then be executed when the saved page is viewed or previewed.
PLUGIN
In The Elementor Website Builder
CVE-2021-24204
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2021-24203 - In The Elementor Website Builder Plugin
In the Elementor Website Builder WordPress plugin before 3.1.4, the divider widget (includes/widgets/divider.php) accepts an ‘html_tag’ parameter. Although the element control lists a fixed set of possible html tags, it is possible for a user with Contributor or above permissions to send a modified ‘save_builder’ request with this parameter set to ‘script’ and combined with a ‘text’ parameter containing JavaScript, which will then be executed when the saved page is viewed or previewed.
PLUGIN
In The Elementor Website Builder
CVE-2021-24203
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2021-24207 - Wp Page Builder Plugin
By default, the WP Page Builder WordPress plugin before 1.2.4 allows subscriber-level users to edit and make changes to any and all posts pages - user roles must be specifically blocked from editing posts and pages.
PLUGIN
Wp Page Builder
CVE-2021-24207
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2021-24175 - Plus Addons For Elementor Page Builder Plugin
The Plus Addons for Elementor Page Builder WordPress plugin before 4.1.7 was being actively exploited to by malicious actors to bypass authentication, allowing unauthenticated users to log in as any user (including admin) by just providing the related username, as well as create accounts with arbitrary roles, such as admin. These issues can be exploited even if registration is disabled, and the Login widget is not active.
PLUGIN
Plus Addons For Elementor Page Builder
CVE-2021-24175
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2021-24184 - Elearning And Online Course Solution Plugin
Several AJAX endpoints in the Tutor LMS – eLearning and online course solution WordPress plugin before 1.7.7 were unprotected, allowing students to modify course information and elevate their privileges among many other actions.
PLUGIN
Elearning And Online Course Solution
CVE-2021-24184
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2021-24174 - Database Backups Plugin
The Database Backups WordPress plugin through 1.2.2.6 does not have CSRF checks, allowing attackers to make a logged in user unwanted actions, such as generate backups of the database, change the plugin's settings and delete backups.
PLUGIN
Database Backups
CVE-2021-24174
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2021-24186 - Elearning And Online Course Solution Plugin
The tutor_answering_quiz_question/get_answer_by_id function pair from the Tutor LMS – eLearning and online course solution WordPress plugin before 1.8.3 was vulnerable to UNION based SQL injection that could be exploited by students.
PLUGIN
Elearning And Online Course Solution
CVE-2021-24186
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2021-24185 - Elearning And Online Course Solution Plugin
The tutor_place_rating AJAX action from the Tutor LMS – eLearning and online course solution WordPress plugin before 1.7.7 was vulnerable to blind and time based SQL injections that could be exploited by students.
PLUGIN
Elearning And Online Course Solution
CVE-2021-24185
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2021-24183 - Elearning And Online Course Solution Plugin
The tutor_quiz_builder_get_question_form AJAX action from the Tutor LMS – eLearning and online course solution WordPress plugin before 1.8.3 was vulnerable to UNION based SQL injection that could be exploited by students.
PLUGIN
Elearning And Online Course Solution
CVE-2021-24183
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2021-24182 - Elearning And Online Course Solution Plugin
The tutor_quiz_builder_get_answers_by_question AJAX action from the Tutor LMS – eLearning and online course solution WordPress plugin before 1.8.3 was vulnerable to UNION based SQL injection that could be exploited by students.
PLUGIN
Elearning And Online Course Solution
CVE-2021-24182
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2021-24181 - Elearning And Online Course Solution Plugin
The tutor_mark_answer_as_correct AJAX action from the Tutor LMS – eLearning and online course solution WordPress plugin before 1.7.7 was vulnerable to blind and time based SQL injections that could be exploited by students.
PLUGIN
Elearning And Online Course Solution
CVE-2021-24181
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2021-24202 - In The Elementor Website Builder Plugin
In the Elementor Website Builder WordPress plugin before 3.1.4, the heading widget (includes/widgets/heading.php) accepts a ‘header_size’ parameter. Although the element control lists a fixed set of possible html tags, it is possible for a user with Contributor or above permissions to send a modified ‘save_builder’ request with this parameter set to ‘script’ and combined with a ‘title’ parameter containing JavaScript, which will then be executed when the saved page is viewed or previewed.
PLUGIN
In The Elementor Website Builder
CVE-2021-24202
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2021-24201 - In The Elementor Website Builder Plugin
In the Elementor Website Builder WordPress plugin before 3.1.4, the column element (includes/elements/column.php) accepts an ‘html_tag’ parameter. Although the element control lists a fixed set of possible html tags, it is possible for a user with Contributor or above permissions to send a modified ‘save_builder’ request containing JavaScript in the ‘html_tag’ parameter, which is not filtered and is output without escaping. This JavaScript will then be executed when the saved page is viewed or previewed.
PLUGIN
In The Elementor Website Builder
CVE-2021-24201
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2021-24196 - Social Slider Widget Plugin
The Social Slider Widget WordPress plugin before 1.8.5 allowed Authenticated Reflected XSS in the plugin settings page as the ‘token_error’ parameter can be controlled by users and it is directly echoed without being sanitized
PLUGIN
Social Slider Widget
CVE-2021-24196
Risk Score