Live Vulnerability Intelligence
Threat Database
Search CVEs, inspect descriptions, and open detail pages with AI-assisted technical context.
Threat Entry
Updated 2024-11-21
CVE-2021-24884 - Formidable Form Builder Plugin
The Formidable Form Builder WordPress plugin before 4.09.05 allows to inject certain HTML Tags like ,,, and.This could allow an unauthenticated, remote attacker to exploit a HTML-injection byinjecting a malicous link. The HTML-injection may trick authenticated users to follow the link. If the Link gets clicked, Javascript code can be executed. The vulnerability is due to insufficient sanitization of the "data-frmverify" tag for links in the web-based entry inspection page of affected systems. A successful exploitation incomibantion with CSRF could allow the attacker to perform arbitrary actions on an affected…
PLUGIN
Formidable Form Builder
CVE-2021-24884
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2021-36879 - Ulisting Plugin
Unauthenticated Privilege Escalation vulnerability in WordPress uListing plugin (versions
PLUGIN
Ulisting
CVE-2021-36879
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2021-24666 - Podlove Podcast Publisher Plugin
The Podlove Podcast Publisher WordPress plugin before 3.5.6 contains a 'Social & Donations' module (not activated by default), which adds the rest route '/services/contributor/(?P[\d]+), takes an 'id' and 'category' parameters as arguments. Both parameters can be used for the SQLi.
PLUGIN
Podlove Podcast Publisher
CVE-2021-24666
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2021-24741 - Support Board Plugin
The Support Board WordPress plugin before 3.3.4 does not escape multiple POST parameters (such as status_code, department, user_id, conversation_id, conversation_status_code, and recipient_id) before using them in SQL statements, leading to SQL injections which are exploitable by unauthenticated users.
PLUGIN
Support Board
CVE-2021-24741
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2021-24638 - Before 4 Plugin
The OMGF WordPress plugin before 4.5.4 does not escape or validate the handle parameter of the REST API, which allows unauthenticated users to perform path traversal and overwrite arbitrary CSS file with Google Fonts CSS, or download fonts uploaded on Google Fonts website.
PLUGIN
Before 4
CVE-2021-24638
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2021-24493 - Shopp Plugin
The shopp_upload_file AJAX action of the Shopp WordPress plugin through 1.4, available to both unauthenticated and authenticated user does not have any security measure in place to prevent upload of malicious files, such as PHP, allowing unauthenticated users to upload arbitrary files and leading to RCE
PLUGIN
Shopp
CVE-2021-24493
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2021-34646 - Booster For Woocommerce Plugin
Versions up to, and including, 5.4.3, of the Booster for WooCommerce WordPress plugin are vulnerable to authentication bypass via the process_email_verification function due to a random token generation weakness in the reset_and_mail_activation_link function found in the ~/includes/class-wcj-emails-verification.php file. This allows attackers to impersonate users and trigger an email address verification for arbitrary accounts, including administrative accounts, and automatically be logged in as that user, including any site administrators. This requires the Email Verification module to be active in the plugin and the Login User After Successful Verification setting to be…
PLUGIN
Booster For Woocommerce
CVE-2021-34646
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2021-24551 - Edit Comments Plugin
The Edit Comments WordPress plugin through 0.3 does not sanitise, validate or escape the jal_edit_comments GET parameter before using it in a SQL statement, leading to a SQL injection issue
PLUGIN
Edit Comments
CVE-2021-24551
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2021-37597 - N A Plugin
WP Cerber before 8.9.3 allows MFA bypass via wordpress_logged_in_[hash] manipulation.
PLUGIN
N A
CVE-2021-37597
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2021-24527 - Profile Builder Plugin
The User Registration & User Profile – Profile Builder WordPress plugin before 3.4.9 has a bug allowing any user to reset the password of the admin of the blog, and gain unauthorised access, due to a bypass in the way the reset key is checked. Furthermore, the admin will not be notified of such change by email for example.
PLUGIN
Profile Builder
CVE-2021-24527
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2021-24507 - Astra Pro Addon Plugin
The Astra Pro Addon WordPress plugin before 3.5.2 did not properly sanitise or escape some of the POST parameters from the astra_pagination_infinite and astra_shop_pagination_infinite AJAX action (available to both unauthenticated and authenticated user) before using them in SQL statement, leading to an SQL Injection issues
PLUGIN
Astra Pro Addon
CVE-2021-24507
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2021-24499 - Before 2 Theme
The Workreap WordPress theme before 2.2.2 AJAX actions workreap_award_temp_file_uploader and workreap_temp_file_uploader did not perform nonce checks, or validate that the request is from a valid user in any other way. The endpoints allowed for uploading arbitrary files to the uploads/workreap-temp directory. Uploaded files were neither sanitized nor validated, allowing an unauthenticated visitor to upload executable code such as php scripts.
THEME
Before 2
CVE-2021-24499
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2021-24472 - 2 And Qt Kentharadio Plugin
The OnAir2 WordPress theme before 3.9.9.2 and QT KenthaRadio WordPress plugin before 2.0.2 have exposed proxy functionality to unauthenticated users, sending requests to this proxy functionality will have the web server fetch and display the content from any URI, this would allow for SSRF (Server Side Request Forgery) and RFI (Remote File Inclusion) vulnerabilities on the website.
PLUGIN
2 And Qt Kentharadio
CVE-2021-24472
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2021-24442 - Questionnaire And Voting System Plugin
The Poll, Survey, Questionnaire and Voting system WordPress plugin before 1.5.3 did not sanitise, escape or validate the date_answers[] POST parameter before using it in a SQL statement when sending a Poll result, allowing unauthenticated users to perform SQL Injection attacks
PLUGIN
Questionnaire And Voting System
CVE-2021-24442
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2021-34624 - Profilepress Plugin
A vulnerability in the file uploader component found in the ~/src/Classes/FileUploader.php file of the ProfilePress WordPress plugin made it possible for users to upload arbitrary files during user registration or during profile updates. This issue affects versions 3.0.0 - 3.1.3. .
PLUGIN
Profilepress
CVE-2021-34624
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2021-34623 - Profilepress Plugin
A vulnerability in the image uploader component found in the ~/src/Classes/ImageUploader.php file of the ProfilePress WordPress plugin made it possible for users to upload arbitrary files during user registration or during profile updates. This issue affects versions 3.0.0 - 3.1.3. .
PLUGIN
Profilepress
CVE-2021-34623
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2021-34622 - Profilepress Plugin
A vulnerability in the user profile update component found in the ~/src/Classes/EditUserProfile.php file of the ProfilePress WordPress plugin made it possible for users to escalate their privileges to that of an administrator while editing their profile. This issue affects versions 3.0.0 - 3.1.3. .
PLUGIN
Profilepress
CVE-2021-34622
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2021-34621 - Profilepress Plugin
A vulnerability in the user registration component found in the ~/src/Classes/RegistrationAuth.php file of the ProfilePress WordPress plugin made it possible for users to register on sites as an administrator. This issue affects versions 3.0.0 - 3.1.3. .
PLUGIN
Profilepress
CVE-2021-34621
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2021-24384 - Load Ajax Action Of The Joomsport Plugin
The joomsport_md_load AJAX action of the JoomSport WordPress plugin before 5.1.8, registered for both unauthenticated and unauthenticated users, unserialised user input from the shattr POST parameter, leading to a PHP Object Injection issue. Even though the plugin does not have a suitable gadget chain to exploit this, other installed plugins could, which might lead to more severe issues such as RCE
PLUGIN
Load Ajax Action Of The Joomsport
CVE-2021-24384
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2021-24375 - View Ajax Handlers Of The Motor Theme
Lack of authentication or validation in motor_load_more, motor_gallery_load_more, motor_quick_view and motor_project_quick_view AJAX handlers of the Motor WordPress theme before 3.1.0 allows an unauthenticated attacker access to arbitrary files in the server file system, and to execute arbitrary php scripts found on the server file system. We found no vulnerability for uploading files with this theme, so any scripts to be executed must already be on the server file system.
THEME
View Ajax Handlers Of The Motor
CVE-2021-24375
Risk Score