CVE-2021-34664

The CVE-2021-34664 entry documents a Reflected Cross-Site Scripting (XSS) vulnerability in the WordPress plugin Moova for WooCommerce . The issue is triggered by the lat parameter in the file path ~/Checkout/Checkout.php, allowing injection of arbitrary scripts in vulnerable versions up to 3.5. M...

CVE-2021-34664 Moova for WooCommerce <= 3.5 Reflected Cross-Site Scripting

The Moova for WooCommerce WordPress plugin is vulnerable to Reflected Cross-Site Scripting via the lat parameter in the /Checkout/Checkout.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 3.5...

CVE-2021-34659

The CVE-2021-34659 entry concerns the WordPress Plugmatter Pricing Table Lite plugin. Affected component: license.php parameter email, which is vulnerable to Reflected Cross-Site Scripting (XSS) in versions up to and including 1.0.32. The underlying issue is a reflected XSS flaw that allows injec...

CVE-2021-34659 Plugmatter Pricing Table Lite <= 1.0.32 Reflected Cross-Site Scripting

The Plugmatter Pricing Table Lite WordPress plugin is vulnerable to Reflected Cross-Site Scripting via the email parameter in the /license.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 1.0.32...

CVE-2021-34659 Plugmatter Pricing Table Lite <= 1.0.32 Reflected Cross-Site Scripting

The Plugmatter Pricing Table Lite WordPress plugin is vulnerable to Reflected Cross-Site Scripting via the email parameter in the /license.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 1.0.32...

CVE-2021-34663 jQuery Tagline Rotator <= 0.1.5 Reflected Cross-Site Scripting

The jQuery Tagline Rotator WordPress plugin is vulnerable to Reflected Cross-Site Scripting due to the use of $SERVER'PHPSELF' in the /jquery-tagline-rotator.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 0.1.5...

CVE-2021-34663 jQuery Tagline Rotator <= 0.1.5 Reflected Cross-Site Scripting

The jQuery Tagline Rotator WordPress plugin is vulnerable to Reflected Cross-Site Scripting due to the use of $SERVER'PHPSELF' in the /jquery-tagline-rotator.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 0.1.5...

CVE-2021-34658 Simple Popup Newsletter <= 1.4.7 Reflected Cross-Site Scripting

The Simple Popup Newsletter WordPress plugin is vulnerable to Reflected Cross-Site Scripting due to the use of $SERVER'PHPSELF' in the /simple-popup-newsletter.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 1.4.7...

CVE-2021-34658 Simple Popup Newsletter <= 1.4.7 Reflected Cross-Site Scripting

The Simple Popup Newsletter WordPress plugin is vulnerable to Reflected Cross-Site Scripting due to the use of $SERVER'PHPSELF' in the /simple-popup-newsletter.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 1.4.7...

CVE-2021-34655

The WP Songbook WordPress plugin is vulnerable to Reflected Cross-Site Scripting via the url parameter in ~/inc/class.ajax.php, affecting versions up to 2.0.11. This allows injecting arbitrary web scripts. Exploitation status and fixes are not provided in the supplied documents; no remediation de...

CVE-2021-34657

CVE-2021-34657 affects the WordPress plugin 2TypoFR (

CVE-2021-34657 TypoFR <= 0.11 Reflected Cross-Site Scripting

The 2TypoFR WordPress plugin is vulnerable to Reflected Cross-Site Scripting via the text function found in the /vendor/OrgHeigl/Hyphenator/index.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 0.11...

CVE-2021-34656 2Way VideoCalls and Random Chat - HTML5 Webcam Videochat <= 5.2.7 Reflected Cross-Site Scripting

The 2Way VideoCalls and Random Chat - HTML5 Webcam Videochat WordPress plugin is vulnerable to Reflected Cross-Site Scripting via the vwsnotice function found in the /inc/requirements.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 5.2.7...

CVE-2021-34656

The CVE-2021-34656 entry documents a Reflected Cross-Site Scripting (XSS) vulnerability in the WordPress plugin “2Way VideoCalls and Random Chat – HTML5 Webcam Videochat”. The issue is triggered via the vws_notice function in the file ~/inc/requirements.php and affects versions up to and includin...

CVE-2021-34651

The CVE-2021-34651 entry concerns the WordPress Scribble Maps plugin. Affected software: Scribble Maps WordPress plugin (versions up to and including 1.2). Vulnerable component/trigger: Reflected Cross-Site Scripting via the map parameter in the ~/includes/admin.php file. Underlying issue: reflec...

CVE-2021-34651 Scribble Maps <= 1.2 Reflected Cross-Site Scripting

The Scribble Maps WordPress plugin is vulnerable to Reflected Cross-Site Scripting via the map parameter in the /includes/admin.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 1.2...

CVE-2021-34654 Custom Post Type Relations <= 1.0 Reflected Cross-Site Scripting

The Custom Post Type Relations WordPress plugin is vulnerable to Reflected Cross-Site Scripting via the cptrname parameter found in the /pages/admin-page.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 1.0...

CVE-2021-34654 Custom Post Type Relations <= 1.0 Reflected Cross-Site Scripting

The Custom Post Type Relations WordPress plugin is vulnerable to Reflected Cross-Site Scripting via the cptrname parameter found in the /pages/admin-page.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 1.0...

CVE-2021-34653 WP Fountain <= 1.5.9 Reflected Cross-Site Scripting

The WP Fountain WordPress plugin is vulnerable to Reflected Cross-Site Scripting due to the use of $SERVER'PHPSELF' in the /wp-fountain.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 1.5.9...

CVE-2021-34653 WP Fountain <= 1.5.9 Reflected Cross-Site Scripting

The WP Fountain WordPress plugin is vulnerable to Reflected Cross-Site Scripting due to the use of $SERVER'PHPSELF' in the /wp-fountain.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 1.5.9...