Live Vulnerability Intelligence
Threat Database
Search CVEs, inspect descriptions, and open detail pages with AI-assisted technical context.
Threat Entry
Updated 2024-11-21
CVE-2021-20779 - Wp Html Mail Plugin
Cross-site request forgery (CSRF) vulnerability in WordPress Email Template Designer - WP HTML Mail versions prior to 3.0.8 allows remote attackers to hijack the authentication of administrators via unspecified vectors.
PLUGIN
Wp Html Mail
CVE-2021-20779
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2021-24451 - Export Users With Meta Plugin
The Export Users With Meta WordPress plugin before 0.6.5 did not escape the list of roles to export before using them in a SQL statement in the export functionality, available to admins, leading to an authenticated SQL Injection.
PLUGIN
Export Users With Meta
CVE-2021-24451
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2021-24377 - Before 2 Plugin
The Autoptimize WordPress plugin before 2.7.8 attempts to remove potential malicious files from the extracted archive uploaded via the 'Import Settings' feature, however this is not sufficient to protect against RCE as a race condition can be achieved in between the moment the file is extracted on the disk but not yet removed. It is a bypass of CVE-2020-24948.
PLUGIN
Before 2
CVE-2021-24377
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2021-24356 - In The Simple 301 Redirects By Betterlinks Plugin
In the Simple 301 Redirects by BetterLinks WordPress plugin before 2.0.4, a lack of capability checks and insufficient nonce check on the AJAX action, simple301redirects/admin/activate_plugin, made it possible for authenticated users to activate arbitrary plugins installed on vulnerable sites.
PLUGIN
In The Simple 301 Redirects By Betterlinks
CVE-2021-24356
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2021-24354 - Ficient Nonce Check On The Ajax Action In The Simple 301 Redirects By Betterlinks Plugin
A lack of capability checks and insufficient nonce check on the AJAX action in the Simple 301 Redirects by BetterLinks WordPress plugin before 2.0.4, made it possible for authenticated users to install arbitrary plugins on vulnerable sites.
PLUGIN
Ficient Nonce Check On The Ajax Action In The Simple 301 Redirects By Betterlinks
CVE-2021-24354
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2021-24353 - Data Function Of The Simple 301 Redirects By Betterlinks Plugin
The import_data function of the Simple 301 Redirects by BetterLinks WordPress plugin before 2.0.4 had no capability or nonce checks making it possible for unauthenticated users to import a set of site redirects.
PLUGIN
Data Function Of The Simple 301 Redirects By Betterlinks
CVE-2021-24353
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2021-24352 - Data Function Of The Simple 301 Redirects By Betterlinks Plugin
The export_data function of the Simple 301 Redirects by BetterLinks WordPress plugin before 2.0.4 had no capability or nonce checks making it possible for unauthenticated users to export a site's redirects.
PLUGIN
Data Function Of The Simple 301 Redirects By Betterlinks
CVE-2021-24352
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2021-24347 - Document Manager Plugin
The SP Project & Document Manager WordPress plugin before 4.22 allows users to upload files, however, the plugin attempts to prevent php and other similar files that could be executed on the server from being uploaded by checking the file extension. It was discovered that php files could still be uploaded by changing the file extension's case, for example, from "php" to "pHP".
PLUGIN
Document Manager
CVE-2021-24347
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2021-24341 - When Deleting A Date In The Xllentech English Islamic Calendar Plugin
When deleting a date in the Xllentech English Islamic Calendar WordPress plugin before 2.6.8, the year_number and month_number POST parameters are not sanitised, escaped or validated before being used in a SQL statement, leading to SQL injection.
PLUGIN
When Deleting A Date In The Xllentech English Islamic Calendar
CVE-2021-24341
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2021-24348 - Add Fixed Side Buttons Plugin
The menu delete functionality of the Side Menu – add fixed side buttons WordPress plugin before 3.1.5, available to Administrator users takes the did GET parameter and uses it into an SQL statement without proper sanitisation, validation or escaping, therefore leading to a SQL Injection issue
PLUGIN
Add Fixed Side Buttons
CVE-2021-24348
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2021-24337 - Video Embed Box Plugin
The id GET parameter of one of the Video Embed WordPress plugin through 1.0's page (available via forced browsing) is not sanitised, validated or escaped before being used in a SQL statement, allowing low privilege users, such as subscribers, to perform SQL injection.
PLUGIN
Video Embed Box
CVE-2021-24337
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2021-24340 - Wp Statistics Plugin
The WP Statistics WordPress plugin before 13.0.8 relied on using the WordPress esc_sql() function on a field not delimited by quotes and did not first prepare the query. Additionally, the page, which should have been accessible to administrator only, was also available to any visitor, including unauthenticated ones.
PLUGIN
Wp Statistics
CVE-2021-24340
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2021-24336 - Flightlog Plugin
The FlightLog WordPress plugin through 3.0.2 does not sanitise, validate or escape various POST parameters before using them a SQL statement, leading to SQL injections exploitable by editor and administrator users
PLUGIN
Flightlog
CVE-2021-24336
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2021-24311 - Upload Remote File Ajax Action Of The External Media Plugin
The wp_ajax_upload-remote-file AJAX action of the External Media WordPress plugin before 1.0.34 was vulnerable to arbitrary file uploads via any authenticated users.
PLUGIN
Upload Remote File Ajax Action Of The External Media
CVE-2021-24311
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2021-24312 - Pages Used In The Settings Of Wp Super Cache Plugin
The parameters $cache_path, $wp_cache_debug_ip, $wp_super_cache_front_page_text, $cache_scheduled_time, $cached_direct_pages used in the settings of WP Super Cache WordPress plugin before 1.7.3 result in RCE because they allow input of '$' and '\n'. This is due to an incomplete fix of CVE-2021-24209.
PLUGIN
Pages Used In The Settings Of Wp Super Cache
CVE-2021-24312
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2021-24307 - All In One Seo Plugin
The All in One SEO – Best WordPress SEO Plugin – Easily Improve Your SEO Rankings before 4.1.0.2 enables authenticated users with "aioseo_tools_settings" privilege (most of the time admin) to execute arbitrary code on the underlying host. Users can restore plugin's configuration by uploading a backup .ini file in the section "Tool > Import/Export". However, the plugin attempts to unserialize values of the .ini file. Moreover, the plugin embeds Monolog library which can be used to craft a gadget chain and thus trigger system command execution.
PLUGIN
All In One Seo
CVE-2021-24307
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2021-24289 - Store Locator Plus Plugin
There is functionality in the Store Locator Plus for WordPress plugin through 5.5.14 that made it possible for authenticated users to update their user meta data to become an administrator on any site using the plugin.
PLUGIN
Store Locator Plus
CVE-2021-24289
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2021-24295 - Firewall By Cleantalk Plugin
It was possible to exploit an Unauthenticated Time-Based Blind SQL Injection vulnerability in the Spam protection, AntiSpam, FireWall by CleanTalk WordPress Plugin before 5.153.4. The update_log function in lib/Cleantalk/ApbctWP/Firewall/SFW.php included a vulnerable query that could be injected via the User-Agent Header by manipulating the cookies set by the Spam protection, AntiSpam, FireWall by CleanTalk WordPress plugin before 5.153.4, sending an initial request to obtain a ct_sfw_pass_key cookie and then manually setting a separate ct_sfw_passed cookie and disallowing it from being reset.
PLUGIN
Firewall By Cleantalk
CVE-2021-24295
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2021-24280 - In The Redirection For Contact Form 7 Plugin
In the Redirection for Contact Form 7 WordPress plugin before 2.3.4, any authenticated user, such as a subscriber, could use the import_from_debug AJAX action to inject PHP objects.
PLUGIN
In The Redirection For Contact Form 7
CVE-2021-24280
Risk Score
Threat Entry
Updated 2024-11-21
CVE-2021-24195 - Before 1 Plugin
Low privileged users can use the AJAX action 'cp_plugins_do_button_job_later_callback' in the Login as User or Customer (User Switching) WordPress plugin before 1.8, to install any plugin (including a specific version) from the WordPress repository, as well as activate arbitrary plugin from then blog, which helps attackers install vulnerable plugins and could lead to more critical vulnerabilities like RCE.
PLUGIN
Before 1
CVE-2021-24195
Risk Score