CVE-2021-34666 Add Sidebar <= 2.0.0 Reflected Cross-Site Scripting

The Add Sidebar WordPress plugin is vulnerable to Reflected Cross-Site Scripting via the add parameter in the /wpsidebarMenu.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 2.0.0...

CVE-2021-34666

The CVE-2021-34666 entry concerns the WordPress Add Sidebar plugin, affected in versions up to and including 2.0.0. The vulnerability is a Reflected Cross-Site Scripting (XSS) flaw triggered via the add parameter in the ~/wp_sidebarMenu.php script, enabling an attacker to inject arbitrary scripts...

CVE-2021-34665

CVE-2021-34665 : The WordPress plugin WP SEO Tags has a Reflected Cross-Site Scripting vulnerability via the saq_txt_the_filter parameter in the ~/wp-seo-tags.php file, affecting versions up to and including 2.2.7. The issue allows injection of arbitrary web scripts and is triggered by user input...

CVE-2021-34665 WP SEO Tags <= 2.2.7 Reflected Cross-Site Scripting

The WP SEO Tags WordPress plugin is vulnerable to Reflected Cross-Site Scripting via the saqtxtthefilter parameter in the /wp-seo-tags.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 2.2.7...

CVE-2021-34664

The CVE-2021-34664 entry documents a Reflected Cross-Site Scripting (XSS) vulnerability in the WordPress plugin Moova for WooCommerce . The issue is triggered by the lat parameter in the file path ~/Checkout/Checkout.php, allowing injection of arbitrary scripts in vulnerable versions up to 3.5. M...

CVE-2021-34664 Moova for WooCommerce <= 3.5 Reflected Cross-Site Scripting

The Moova for WooCommerce WordPress plugin is vulnerable to Reflected Cross-Site Scripting via the lat parameter in the /Checkout/Checkout.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 3.5...

CVE-2021-34659 Plugmatter Pricing Table Lite <= 1.0.32 Reflected Cross-Site Scripting

The Plugmatter Pricing Table Lite WordPress plugin is vulnerable to Reflected Cross-Site Scripting via the email parameter in the /license.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 1.0.32...

CVE-2021-34659

The CVE-2021-34659 entry concerns the WordPress Plugmatter Pricing Table Lite plugin. Affected component: license.php parameter email, which is vulnerable to Reflected Cross-Site Scripting (XSS) in versions up to and including 1.0.32. The underlying issue is a reflected XSS flaw that allows injec...

CVE-2021-34659 Plugmatter Pricing Table Lite <= 1.0.32 Reflected Cross-Site Scripting

The Plugmatter Pricing Table Lite WordPress plugin is vulnerable to Reflected Cross-Site Scripting via the email parameter in the /license.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 1.0.32...

CVE-2021-34663 jQuery Tagline Rotator <= 0.1.5 Reflected Cross-Site Scripting

The jQuery Tagline Rotator WordPress plugin is vulnerable to Reflected Cross-Site Scripting due to the use of $SERVER'PHPSELF' in the /jquery-tagline-rotator.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 0.1.5...

CVE-2021-34663 jQuery Tagline Rotator <= 0.1.5 Reflected Cross-Site Scripting

The jQuery Tagline Rotator WordPress plugin is vulnerable to Reflected Cross-Site Scripting due to the use of $SERVER'PHPSELF' in the /jquery-tagline-rotator.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 0.1.5...

CVE-2021-34658 Simple Popup Newsletter <= 1.4.7 Reflected Cross-Site Scripting

The Simple Popup Newsletter WordPress plugin is vulnerable to Reflected Cross-Site Scripting due to the use of $SERVER'PHPSELF' in the /simple-popup-newsletter.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 1.4.7...

CVE-2021-34658 Simple Popup Newsletter <= 1.4.7 Reflected Cross-Site Scripting

The Simple Popup Newsletter WordPress plugin is vulnerable to Reflected Cross-Site Scripting due to the use of $SERVER'PHPSELF' in the /simple-popup-newsletter.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 1.4.7...

CVE-2021-34655

The WP Songbook WordPress plugin is vulnerable to Reflected Cross-Site Scripting via the url parameter in ~/inc/class.ajax.php, affecting versions up to 2.0.11. This allows injecting arbitrary web scripts. Exploitation status and fixes are not provided in the supplied documents; no remediation de...

CVE-2021-34657 TypoFR <= 0.11 Reflected Cross-Site Scripting

The 2TypoFR WordPress plugin is vulnerable to Reflected Cross-Site Scripting via the text function found in the /vendor/OrgHeigl/Hyphenator/index.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 0.11...

CVE-2021-34657

CVE-2021-34657 affects the WordPress plugin 2TypoFR (

CVE-2021-34656

The CVE-2021-34656 entry documents a Reflected Cross-Site Scripting (XSS) vulnerability in the WordPress plugin “2Way VideoCalls and Random Chat – HTML5 Webcam Videochat”. The issue is triggered via the vws_notice function in the file ~/inc/requirements.php and affects versions up to and includin...

CVE-2021-34656 2Way VideoCalls and Random Chat - HTML5 Webcam Videochat <= 5.2.7 Reflected Cross-Site Scripting

The 2Way VideoCalls and Random Chat - HTML5 Webcam Videochat WordPress plugin is vulnerable to Reflected Cross-Site Scripting via the vwsnotice function found in the /inc/requirements.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 5.2.7...

CVE-2021-34651

The CVE-2021-34651 entry concerns the WordPress Scribble Maps plugin. Affected software: Scribble Maps WordPress plugin (versions up to and including 1.2). Vulnerable component/trigger: Reflected Cross-Site Scripting via the map parameter in the ~/includes/admin.php file. Underlying issue: reflec...

CVE-2021-34651 Scribble Maps <= 1.2 Reflected Cross-Site Scripting

The Scribble Maps WordPress plugin is vulnerable to Reflected Cross-Site Scripting via the map parameter in the /includes/admin.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 1.2...