Live Vulnerability Intelligence
Threat Database
Search CVEs, inspect descriptions, and open detail pages with AI-assisted technical context.
Threat Entry
Updated 2024-11-21
CVE-2021-24931 - Secure Copy Content Protection And Content Locking Plugin
The Secure Copy Content Protection and Content Locking WordPress plugin before 2.8.2 does not escape the sccp_id parameter of the ays_sccp_results_export_file AJAX action (available to both unauthenticated and authenticated users) before using it in a SQL statement, leading to an SQL injection.
PLUGIN
Secure Copy Content Protection And Content Locking
CVE-2021-24931
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2021-24866 - Wp Data Access Plugin
The WP Data Access WordPress plugin before 5.0.0 does not properly sanitise and escape the backup_date parameter before using it a SQL statement, leading to a SQL injection issue and could allow arbitrary table deletion
PLUGIN
Wp Data Access
CVE-2021-24866
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2021-24915 - Contest Gallery Plugin
The Contest Gallery WordPress plugin before 13.1.0.6 does not have capability checks and does not sanitise or escape the cg-search-user-name-original parameter before using it in a SQL statement when exporting users from a gallery, which could allow unauthenticated to perform SQL injections attacks, as well as get the list of all users registered on the blog, including their username and email address
PLUGIN
Contest Gallery
CVE-2021-24915
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2021-43409 - Wordpress Azure Ad Microsoft Office 365 Plugin
The “WPO365 | LOGIN” WordPress plugin (up to and including version 15.3) by wpo365.com is vulnerable to a persistent Cross-Site Scripting (XSS) vulnerability (also known as Stored or Second-Order XSS). Persistent XSS vulnerabilities occur when the application stores and retrieves client supplied data without proper handling of dangerous content. This type of XSS vulnerability is exploited by submitting malicious script content to the application which is then retrieved and executed by other application users. The attacker could exploit this to conduct a range of attacks against users of the affected…
PLUGIN
Wordpress Azure Ad Microsoft Office 365
CVE-2021-43409
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2021-24827 - Asgaros Forum Plugin
The Asgaros Forum WordPress plugin before 1.15.13 does not validate and escape user input when subscribing to a topic before using it in a SQL statement, leading to an unauthenticated SQL injection issue
PLUGIN
Asgaros Forum
CVE-2021-24827
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2021-24731 - Invitation Codes Plugin
The Registration Forms – User profile, Content Restriction, Spam Protection, Payment Gateways, Invitation Codes WordPress plugin before 3.7.1.6 does not properly escape user data before using it in a SQL statement in the wp-json/pie/v1/login REST API endpoint, leading to an SQL injection.
PLUGIN
Invitation Codes
CVE-2021-24731
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2021-24693 - Simple Download Monitor Plugin
The Simple Download Monitor WordPress plugin before 3.9.5 does not escape the "File Thumbnail" post meta before outputting it in some pages, which could allow users with a role as low as Contributor to perform Stored Cross-Site Scripting attacks. Given the that XSS is triggered even when the Download is in a review state, contributor could make JavaScript code execute in a context of a reviewer such as admin and make them create a rogue admin account, or install a malicious plugin
PLUGIN
Simple Download Monitor
CVE-2021-24693
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2021-24884 - Formidable Form Builder Plugin
The Formidable Form Builder WordPress plugin before 4.09.05 allows to inject certain HTML Tags like ,,, and.This could allow an unauthenticated, remote attacker to exploit a HTML-injection byinjecting a malicous link. The HTML-injection may trick authenticated users to follow the link. If the Link gets clicked, Javascript code can be executed. The vulnerability is due to insufficient sanitization of the "data-frmverify" tag for links in the web-based entry inspection page of affected systems. A successful exploitation incomibantion with CSRF could allow the attacker to perform arbitrary actions on an affected…
PLUGIN
Formidable Form Builder
CVE-2021-24884
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2021-36879 - Ulisting Plugin
Unauthenticated Privilege Escalation vulnerability in WordPress uListing plugin (versions
PLUGIN
Ulisting
CVE-2021-36879
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2021-24666 - Podlove Podcast Publisher Plugin
The Podlove Podcast Publisher WordPress plugin before 3.5.6 contains a 'Social & Donations' module (not activated by default), which adds the rest route '/services/contributor/(?P[\d]+), takes an 'id' and 'category' parameters as arguments. Both parameters can be used for the SQLi.
PLUGIN
Podlove Podcast Publisher
CVE-2021-24666
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2021-24741 - Support Board Plugin
The Support Board WordPress plugin before 3.3.4 does not escape multiple POST parameters (such as status_code, department, user_id, conversation_id, conversation_status_code, and recipient_id) before using them in SQL statements, leading to SQL injections which are exploitable by unauthenticated users.
PLUGIN
Support Board
CVE-2021-24741
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2021-24638 - Before 4 Plugin
The OMGF WordPress plugin before 4.5.4 does not escape or validate the handle parameter of the REST API, which allows unauthenticated users to perform path traversal and overwrite arbitrary CSS file with Google Fonts CSS, or download fonts uploaded on Google Fonts website.
PLUGIN
Before 4
CVE-2021-24638
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2021-24493 - Shopp Plugin
The shopp_upload_file AJAX action of the Shopp WordPress plugin through 1.4, available to both unauthenticated and authenticated user does not have any security measure in place to prevent upload of malicious files, such as PHP, allowing unauthenticated users to upload arbitrary files and leading to RCE
PLUGIN
Shopp
CVE-2021-24493
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2021-34646 - Booster For Woocommerce Plugin
Versions up to, and including, 5.4.3, of the Booster for WooCommerce WordPress plugin are vulnerable to authentication bypass via the process_email_verification function due to a random token generation weakness in the reset_and_mail_activation_link function found in the ~/includes/class-wcj-emails-verification.php file. This allows attackers to impersonate users and trigger an email address verification for arbitrary accounts, including administrative accounts, and automatically be logged in as that user, including any site administrators. This requires the Email Verification module to be active in the plugin and the Login User After Successful Verification setting to be…
PLUGIN
Booster For Woocommerce
CVE-2021-34646
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2021-24551 - Edit Comments Plugin
The Edit Comments WordPress plugin through 0.3 does not sanitise, validate or escape the jal_edit_comments GET parameter before using it in a SQL statement, leading to a SQL injection issue
PLUGIN
Edit Comments
CVE-2021-24551
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2021-37597 - N A Plugin
WP Cerber before 8.9.3 allows MFA bypass via wordpress_logged_in_[hash] manipulation.
PLUGIN
N A
CVE-2021-37597
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2021-24527 - Profile Builder Plugin
The User Registration & User Profile – Profile Builder WordPress plugin before 3.4.9 has a bug allowing any user to reset the password of the admin of the blog, and gain unauthorised access, due to a bypass in the way the reset key is checked. Furthermore, the admin will not be notified of such change by email for example.
PLUGIN
Profile Builder
CVE-2021-24527
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2021-24507 - Astra Pro Addon Plugin
The Astra Pro Addon WordPress plugin before 3.5.2 did not properly sanitise or escape some of the POST parameters from the astra_pagination_infinite and astra_shop_pagination_infinite AJAX action (available to both unauthenticated and authenticated user) before using them in SQL statement, leading to an SQL Injection issues
PLUGIN
Astra Pro Addon
CVE-2021-24507
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2021-24499 - Before 2 Theme
The Workreap WordPress theme before 2.2.2 AJAX actions workreap_award_temp_file_uploader and workreap_temp_file_uploader did not perform nonce checks, or validate that the request is from a valid user in any other way. The endpoints allowed for uploading arbitrary files to the uploads/workreap-temp directory. Uploaded files were neither sanitized nor validated, allowing an unauthenticated visitor to upload executable code such as php scripts.
THEME
Before 2
CVE-2021-24499
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2021-24472 - 2 And Qt Kentharadio Plugin
The OnAir2 WordPress theme before 3.9.9.2 and QT KenthaRadio WordPress plugin before 2.0.2 have exposed proxy functionality to unauthenticated users, sending requests to this proxy functionality will have the web server fetch and display the content from any URI, this would allow for SSRF (Server Side Request Forgery) and RFI (Remote File Inclusion) vulnerabilities on the website.
PLUGIN
2 And Qt Kentharadio
CVE-2021-24472
Risk Score