PT-2021-7088

Name of the Vulnerable Software and Affected Versions Cisco Firepower Threat Defense FTD Software affected versions not specified Description A vulnerability in the Security Intelligence feed feature of Cisco Firepower Threat Defense FTD Software could allow an unauthenticated, remote attacker to...

CVE-2021-24793

The WPeMatico RSS Feed Fetcher WordPress plugin before 2.6.12 does not escape the Feed URL added to a campaign before outputting it in an attribute, allowing high privilege users to perform Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed...

CVE-2021-24793

The WPeMatico RSS Feed Fetcher WordPress plugin before 2.6.12 does not escape the Feed URL added to a campaign before outputting it in an attribute, allowing high privilege users to perform Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed...

Cross site scripting

The WPeMatico RSS Feed Fetcher WordPress plugin before 2.6.12 does not escape the Feed URL added to a campaign before outputting it in an attribute, allowing high privilege users to perform Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed...

CVE-2021-24793 WPeMatico RSS Feed Fetcher < 2.6.12 - Admin+ Stored Cross-Site Scripting

The WPeMatico RSS Feed Fetcher WordPress plugin before 2.6.12 does not escape the Feed URL added to a campaign before outputting it in an attribute, allowing high privilege users to perform Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed...

CVE-2021-24793

CVE-2021-24793 references the WPeMatico RSS Feed Fetcher WordPress plugin, before version 2.6.12, which does not escape the feed URL added to a campaign before outputting it in an attribute. This enables stored Cross‑Site Scripting (XSS) when exploited by high‑privilege users, even when unfiltere...

PT-2021-16288

Name of the Vulnerable Software and Affected Versions: WPeMatico RSS Feed Fetcher WordPress plugin versions prior to 2.6.12 Description: The issue allows high privilege users to perform Cross-Site Scripting attacks due to the Feed URL added to a campaign not being escaped before outputting it in ...

CVE-2021-24793: Improper Neutralization of Input During Web Page Generation

The WPeMatico RSS Feed Fetcher WordPress plugin before 2.6.12 does not escape the Feed URL added to a campaign before outputting it in an attribute, allowing high privilege users to perform Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed...

WordPress cross-site scripting vulnerabilities

WordPress is a set of blogging platforms developed using the PHP language by the WordPress Wordpress Foundation. The platform supports setting up personal blog sites on servers with PHP and MySQL. A cross-site scripting vulnerability exists in the WordPress plugin WPeMatico RSS Feed Fetcher prior...

CVE-2021-34484

creationtimestamp| type| source ---|---|--- 2021-10-29 18:59:00+00:00| exploited| https://t.me/truesecator/2270 2021-10-29 22:19:37+00:00| published-proof-of-concept| https://t.me/hackertrick/363 2021-10-30 14:34:03+00:00| exploited| https://t.me/NeKaspersky/1395 2021-11-10 23:12:02+00:00|...

CVE-2021-38000

creationtimestamp| type| source ---|---|--- 2021-10-29 04:00:00+00:00| seen| https://www.govcert.gov.hk/en/alertsdetail.php?id=682 2021-10-29 06:14:24+00:00| exploited| https://t.me/cKure/7810 2021-10-29 16:50:00+00:00| exploited| https://t.me/truesecator/2268 2021-10-30 15:46:49+00:00| seen|...

Smash Balloon Social Post Feed < 4.0.1 - Subscriber+ Arbitrary Plugin Settings Update to Stored XSS

The plugin did not have any privilege or nonce validation before saving the plugin's setting. As a result, any logged-in user on a vulnerable site could update the settings and store rogue JavaScript on each of its posts and pages...

CVE-2019-7481

creationtimestamp| type| source ---|---|--- 2021-10-25 22:32:42+00:00| seen| MISP/63ddead6-4b82-414c-ad8e-c516b950b446 2021-11-20 09:53:52+00:00| seen| MISP/3c19819c-1dac-4ef2-bfed-be5efa7e0123 2024-12-24 20:21:51+00:00| seen| https://feedsin.space/feed/CISAKevBot/items/2970926 2025-02-23...

CVE-2021-38646

creationtimestamp| type| source ---|---|--- 2021-10-24 07:35:33+00:00| published-proof-of-concept| https://t.me/cKure/7741 2021-10-25 22:32:43+00:00| seen| MISP/63ddead6-4b82-414c-ad8e-c516b950b446 2021-10-30 14:25:18+00:00| published-proof-of-concept| https://t.me/CyberSecurityTechnologies/4632...

CVE-2021-42258

creationtimestamp| type| source ---|---|--- 2021-10-23 02:39:32+00:00| exploited| https://t.me/cibsecurity/31084 2021-10-25 22:32:43+00:00| seen| MISP/63ddead6-4b82-414c-ad8e-c516b950b446 2021-10-26 18:55:45+00:00| seen| https://t.me/truesecator/2254 2021-10-27 10:22:02+00:00| exploited|...

CVE-2021-21743

ZTE MF971R product has a CRLF injection vulnerability. An attacker could exploit the vulnerability to modify the HTTP response header information through a specially crafted HTTP request...

CVE-2021-24413

The Easy Twitter Feed WordPress plugin before 1.2 does not sanitise or validate the parameters from its shortcode, allowing users with a role as low as contributor to set Cross-Site Scripting payload in them which will be triggered in the page/s with the embed malicious shortcode...

CVE-2021-24413

The Easy Twitter Feed WordPress plugin before 1.2 does not sanitise or validate the parameters from its shortcode, allowing users with a role as low as contributor to set Cross-Site Scripting payload in them which will be triggered in the page/s with the embed malicious shortcode...

CVE-2021-24413

The Easy Twitter Feed WordPress plugin before 1.2 does not sanitise or validate the parameters from its shortcode, allowing users with a role as low as contributor to set Cross-Site Scripting payload in them which will be triggered in the page/s with the embed malicious shortcode...

Cross site scripting

The Easy Twitter Feed WordPress plugin before 1.2 does not sanitise or validate the parameters from its shortcode, allowing users with a role as low as contributor to set Cross-Site Scripting payload in them which will be triggered in the page/s with the embed malicious shortcode...