CVE-2021-24387

The WP Pro Real Estate 7 WordPress theme before 3.1.1 did not properly sanitise the ctcommunity parameter in its search listing page before outputting it back in it, leading to a reflected Cross-Site Scripting which can be triggered in both unauthenticated or authenticated user context...

CVE-2021-24375

Lack of authentication or validation in motorloadmore, motorgalleryloadmore, motorquickview and motorprojectquickview AJAX handlers of the Motor WordPress theme before 3.1.0 allows an unauthenticated attacker access to arbitrary files in the server file system, and to execute arbitrary php script...

CVE-2021-24375

Lack of authentication or validation in motorloadmore, motorgalleryloadmore, motorquickview and motorprojectquickview AJAX handlers of the Motor WordPress theme before 3.1.0 allows an unauthenticated attacker access to arbitrary files in the server file system, and to execute arbitrary php script...

Authentication flaw

Lack of authentication or validation in motorloadmore, motorgalleryloadmore, motorquickview and motorprojectquickview AJAX handlers of the Motor WordPress theme before 3.1.0 allows an unauthenticated attacker access to arbitrary files in the server file system, and to execute arbitrary php script...

CVE-2021-24387

The WP Pro Real Estate 7 WordPress theme before 3.1.1 did not properly sanitise the ctcommunity parameter in its search listing page before outputting it back in it, leading to a reflected Cross-Site Scripting which can be triggered in both unauthenticated or authenticated user context...

CVE-2021-24389

The WP Foodbakery WordPress plugin before 2.2, used in the FoodBakery WordPress theme before 2.2 did not properly sanitize the foodbakeryradius parameter before outputting it back in the response, leading to an unauthenticated Reflected Cross-Site Scripting XSS vulnerability...

CVE-2021-24407

The Jannah WordPress theme before 5.4.5 did not properly sanitize the 'query' POST parameter in its tieajaxsearch AJAX action, leading to a Reflected Cross-site Scripting XSS vulnerability...

CVE-2021-24387 Real Estate 7 < 3.1.1 - Reflected Cross-Site Scripting (XSS)

The WP Pro Real Estate 7 WordPress theme before 3.1.1 did not properly sanitise the ctcommunity parameter in its search listing page before outputting it back in it, leading to a reflected Cross-Site Scripting which can be triggered in both unauthenticated or authenticated user context...

CVE-2021-24387

CVE-2021-24387 concerns the WordPress WP Pro Real Estate 7 theme (before 3.1.1). The vulnerability is a reflected cross-site scripting (XSS) caused by improper sanitization of the ct_community parameter on the search listings page, with the payload echoed back in the response. Impact is described...

CVE-2021-24375

CVE-2021-24375 affects WordPress Motor theme versions prior to 3.1.0. The vulnerability is a Local File Inclusion via the motor_load_more, motor_gallery_load_more, motor_quick_view, and motor_project_quick_view AJAX handlers, caused by lack of authentication/validation. An unauthenticated attacke...

PT-2021-15940

Name of the Vulnerable Software and Affected Versions Jannah WordPress theme versions prior to 5.4.5 Description The issue arises from the improper sanitization of the query POST parameter in the tie ajax search AJAX action, leading to a Reflected Cross-site Scripting XSS vulnerability. This allo...

CVE-2021-24375: Improper Limitation of a Pathname to a Restricted Directory

Lack of authentication or validation in motorloadmore, motorgalleryloadmore, motorquickview and motorprojectquickview AJAX handlers of the Motor WordPress theme before 3.1.0 allows an unauthenticated attacker access to arbitrary files in the server file system, and to execute arbitrary php script...

CVE-2021-24407: Improper Neutralization of Input During Web Page Generation

The Jannah WordPress theme before 5.4.5 did not properly sanitize the 'query' POST parameter in its tieajaxsearch AJAX action, leading to a Reflected Cross-site Scripting XSS vulnerability...

CVE-2021-24389: Improper Neutralization of Input During Web Page Generation

The WP Foodbakery WordPress plugin before 2.2, used in the FoodBakery WordPress theme before 2.2 did not properly sanitize the foodbakeryradius parameter before outputting it back in the response, leading to an unauthenticated Reflected Cross-Site Scripting XSS vulnerability...

CVE-2021-24364

The Jannah WordPress theme before 5.4.4 did not properly sanitize the options JSON parameter in its tiegetuserweather AJAX action before outputting it back in the page, leading to a Reflected Cross-Site Scripting XSS vulnerability...

CVE-2021-24364

The Jannah WordPress theme before 5.4.4 did not properly sanitize the options JSON parameter in its tiegetuserweather AJAX action before outputting it back in the page, leading to a Reflected Cross-Site Scripting XSS vulnerability...

CVE-2021-24364: Improper Neutralization of Input During Web Page Generation

The Jannah WordPress theme before 5.4.4 did not properly sanitize the options JSON parameter in its tiegetuserweather AJAX action before outputting it back in the page, leading to a Reflected Cross-Site Scripting XSS vulnerability...

PT-2021-15900

Name of the Vulnerable Software and Affected Versions Jannah WordPress theme versions prior to 5.4.4 Description The issue arises from the improper sanitization of the options JSON parameter in the tie get user weather AJAX action, leading to a Reflected Cross-Site Scripting XSS issue. This occur...

CVE-2021-24342

The JNews WordPress theme before 8.0.6 did not sanitise the catid parameter in the POST request /?ajax-request=jnews with action=jnewsbuildmegacategory, leading to a Reflected Cross-Site Scripting XSS issue...

PT-2021-15878

Name of the Vulnerable Software and Affected Versions JNews WordPress theme versions prior to 8.0.6 Description The issue is related to a Reflected Cross-Site Scripting XSS problem. It occurs because the cat id parameter in the POST request to the / endpoint with ajax-request=jnews and action=jne...