Live Vulnerability Intelligence
Threat Database
Search CVEs, inspect descriptions, and open detail pages with AI-assisted technical context.
Threat Entry
Updated 2024-11-21
CVE-2021-24762 - Perfect Survey Plugin
The Perfect Survey WordPress plugin before 1.5.2 does not validate and escape the question_id GET parameter before using it in a SQL statement in the get_question AJAX action, allowing unauthenticated users to perform SQL injection.
PLUGIN
Perfect Survey
CVE-2021-24762
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2021-24814 - Settings Ajax Action Of The Wordpress Gdpr Plugin
The check_privacy_settings AJAX action of the WordPress GDPR WordPress plugin before 1.9.26, available to both unauthenticated and authenticated users, responds with JSON data without an "application/json" content-type. Since an HTML payload isn't properly escaped, it may be interpreted by a web browser led to this endpoint. Javascript code may be executed on a victim's browser. If the victim is an administrator with a valid session cookie, full control of the WordPress instance may be taken (AJAX calls and iframe manipulation are possible because the vulnerable endpoint is on the same…
PLUGIN
Settings Ajax Action Of The Wordpress Gdpr
CVE-2021-24814
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2021-25032 - Before 2 Plugin
The PublishPress Capabilities WordPress plugin before 2.3.1, PublishPress Capabilities Pro WordPress plugin before 2.3.1 does not have authorisation and CSRF checks when updating the plugin's settings via the init hook, and does not ensure that the options to be updated belong to the plugin. As a result, unauthenticated attackers could update arbitrary blog options, such as the default role and make any new registered user with an administrator role.
PLUGIN
Before 2
CVE-2021-25032
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2021-24949 - Widget Of The Plus Addons For Elementor Pro Plugin
The "WP Search Filters" widget of The Plus Addons for Elementor - Pro WordPress plugin before 5.0.7 does not sanitise and escape the option parameter before using it in a SQL statement, which could lead to SQL injection
PLUGIN
Widget Of The Plus Addons For Elementor Pro
CVE-2021-24949
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2021-24849 - Controller Ajax Action Of The Wcfm Marketplace Plugin
The wcfm_ajax_controller AJAX action of the WCFM Marketplace WordPress plugin before 3.4.12, available to unauthenticated and authenticated user, does not properly sanitise multiple parameters before using them in SQL statements, leading to SQL injections
PLUGIN
Controller Ajax Action Of The Wcfm Marketplace
CVE-2021-24849
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2021-36888 - Image Hover Effects Plugin
Unauthenticated Arbitrary Options Update vulnerability leading to full website compromise discovered in Image Hover Effects Ultimate (versions
PLUGIN
Image Hover Effects
CVE-2021-36888
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2021-4073 - Registrationmagic Plugin
The RegistrationMagic WordPress plugin made it possible for unauthenticated users to log in as any site user, including administrators, if they knew a valid username on the site due to missing identity validation in the social login function social_login_using_email() of the plugin. This affects versions equal to, and less than, 5.0.1.7.
PLUGIN
Registrationmagic
CVE-2021-4073
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2021-24951 - Before 4 Plugin
The LearnPress WordPress plugin before 4.1.4 does not sanitise, validate and escape the id parameter before using it in SQL statements when duplicating course/lesson/quiz/question, leading to SQL Injections issues
PLUGIN
Before 4
CVE-2021-24951
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2021-24946 - Modern Events Calendar Lite Plugin
The Modern Events Calendar Lite WordPress plugin before 6.1.5 does not sanitise and escape the time parameter before using it in a SQL statement in the mec_load_single_page AJAX action, available to unauthenticated users, leading to an unauthenticated SQL injection issue
PLUGIN
Modern Events Calendar Lite
CVE-2021-24946
Risk Score
Threat Entry
Updated 2026-01-16
CVE-2021-24863 - Nd Stop Bad Bots Crawlers And Spiders And Anti Spam Protection Plugin Stopbadbots
The WP Block and Stop Bad Bots Crawlers and Spiders and Anti Spam Protection Plugin StopBadBots WordPress plugin before 6.67 does not sanitise and escape the User Agent before using it in a SQL statement to save it, leading to a SQL injection
PLUGIN
Nd Stop Bad Bots Crawlers And Spiders And Anti Spam Protection Plugin Stopbadbots
CVE-2021-24863
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2021-24857 - Totop Link Plugin
The ToTop Link WordPress plugin through 1.7.1 passes base64 encoded user input to the unserialize() PHP function, which could lead to PHP Object injection if a plugin installed on the blog has a suitable gadget chain.
PLUGIN
Totop Link
CVE-2021-24857
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2021-24922 - Before 2 Plugin
The Pixel Cat WordPress plugin before 2.6.2 does not have CSRF check when saving its settings, and did not sanitise as well as escape some of them, which could allow attacker to make a logged in admin change them and perform Cross-Site Scripting attacks
PLUGIN
Before 2
CVE-2021-24922
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2021-24943 - Registrations For The Events Calendar Plugin
The Registrations for the Events Calendar WordPress plugin before 2.7.6 does not sanitise and escape the event_id in the rtec_send_unregister_link AJAX action (available to both unauthenticated and authenticated users) before using it in a SQL statement, leading to an unauthenticated SQL injection.
PLUGIN
Registrations For The Events Calendar
CVE-2021-24943
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2021-24931 - Secure Copy Content Protection And Content Locking Plugin
The Secure Copy Content Protection and Content Locking WordPress plugin before 2.8.2 does not escape the sccp_id parameter of the ays_sccp_results_export_file AJAX action (available to both unauthenticated and authenticated users) before using it in a SQL statement, leading to an SQL injection.
PLUGIN
Secure Copy Content Protection And Content Locking
CVE-2021-24931
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2021-24866 - Wp Data Access Plugin
The WP Data Access WordPress plugin before 5.0.0 does not properly sanitise and escape the backup_date parameter before using it a SQL statement, leading to a SQL injection issue and could allow arbitrary table deletion
PLUGIN
Wp Data Access
CVE-2021-24866
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2021-24915 - Contest Gallery Plugin
The Contest Gallery WordPress plugin before 13.1.0.6 does not have capability checks and does not sanitise or escape the cg-search-user-name-original parameter before using it in a SQL statement when exporting users from a gallery, which could allow unauthenticated to perform SQL injections attacks, as well as get the list of all users registered on the blog, including their username and email address
PLUGIN
Contest Gallery
CVE-2021-24915
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2021-43409 - Wordpress Azure Ad Microsoft Office 365 Plugin
The “WPO365 | LOGIN” WordPress plugin (up to and including version 15.3) by wpo365.com is vulnerable to a persistent Cross-Site Scripting (XSS) vulnerability (also known as Stored or Second-Order XSS). Persistent XSS vulnerabilities occur when the application stores and retrieves client supplied data without proper handling of dangerous content. This type of XSS vulnerability is exploited by submitting malicious script content to the application which is then retrieved and executed by other application users. The attacker could exploit this to conduct a range of attacks against users of the affected…
PLUGIN
Wordpress Azure Ad Microsoft Office 365
CVE-2021-43409
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2021-24827 - Asgaros Forum Plugin
The Asgaros Forum WordPress plugin before 1.15.13 does not validate and escape user input when subscribing to a topic before using it in a SQL statement, leading to an unauthenticated SQL injection issue
PLUGIN
Asgaros Forum
CVE-2021-24827
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2021-24731 - Invitation Codes Plugin
The Registration Forms – User profile, Content Restriction, Spam Protection, Payment Gateways, Invitation Codes WordPress plugin before 3.7.1.6 does not properly escape user data before using it in a SQL statement in the wp-json/pie/v1/login REST API endpoint, leading to an SQL injection.
PLUGIN
Invitation Codes
CVE-2021-24731
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2021-24693 - Simple Download Monitor Plugin
The Simple Download Monitor WordPress plugin before 3.9.5 does not escape the "File Thumbnail" post meta before outputting it in some pages, which could allow users with a role as low as Contributor to perform Stored Cross-Site Scripting attacks. Given the that XSS is triggered even when the Download is in a review state, contributor could make JavaScript code execute in a context of a reviewer such as admin and make them create a rogue admin account, or install a malicious plugin
PLUGIN
Simple Download Monitor
CVE-2021-24693
Risk Score