CVE-2021-24627 G Auto-Hyperlink <= 1.0.1 - Admin+ SQL Injection

The G Auto-Hyperlink WordPress plugin through 1.0.1 does not sanitise or escape an 'id' GET parameter before using it in a SQL statement, to select data to be displayed in the admin dashboard, leading to an authenticated SQL injection...

CVE-2021-24625 SpiderCatalog <= 1.7.3 - Admin+ SQL Injection

The SpiderCatalog WordPress plugin through 1.7.3 does not sanitise or escape the 'parent' and 'ordering' parameters from the admin dashboard before using them in a SQL statement, leading to a SQL injection when adding a category...

CVE-2021-24625

The CVE-2021-24625 entry concerns the WordPress plugin SpiderCatalog (versions ≤ 1.7.3). The vulnerability stems from unsanitized/uncleaned the 'parent' and 'ordering' parameters in admin actions, which are directly used in a SQL statement, enabling SQL injection when adding categories. Impact st...

PT-2021-16286

Name of the Vulnerable Software and Affected Versions: The Header Footer Code Manager WordPress plugin versions prior to 1.1.14 Description: The issue arises from the lack of validation and escaping of the orderby and order request parameters before they are used in a SQL statement when viewing t...

CVE-2021-24791: Improper Neutralization of Special Elements used in an SQL Command

The Header Footer Code Manager WordPress plugin before 1.1.14 does not validate and escape the "orderby" and "order" request parameters before using them in a SQL statement when viewing the Snippets admin dashboard, leading to SQL injections...

PT-2021-16144

Name of the Vulnerable Software and Affected Versions Wow Forms WordPress plugin versions prior to 3.1.4 Description The issue arises from the lack of sanitization or escaping of the did GET parameter, which is used in a SQL statement when deleting a form in the admin dashboard. This leads to an...

PT-2021-16145

Name of the Vulnerable Software and Affected Versions Post Content XMLRPC WordPress plugin version 1.0 Description The issue concerns an authenticated SQL injection. It occurs because the plugin does not properly sanitise or escape multiple GET and POST parameters, such as username and password,...

PT-2021-16325

Name of the Vulnerable Software and Affected Versions: Affiliates Manager WordPress plugin versions prior to 2.8.7 Description: The issue arises from the lack of validation of the orderby parameter before its use in an SQL statement within the admin dashboard, leading to an SQL Injection issue...

CVE-2021-24629: Improper Neutralization of Special Elements used in an SQL Command

The Post Content XMLRPC WordPress plugin through 1.0 does not sanitise or escape multiple GET/POST parameters before using them in SQL statements in the admin dashboard, leading to an authenticated SQL Injections...

CVE-2021-24628: Improper Neutralization of Special Elements used in an SQL Command

The Wow Forms WordPress plugin through 3.1.3 does not sanitise or escape a 'did' GET parameter before using it in a SQL statement, when deleting a form in the admin dashboard, leading to an authenticated SQL injection...

CVE-2021-24625: Improper Neutralization of Special Elements used in an SQL Command

The SpiderCatalog WordPress plugin through 1.7.3 does not sanitise or escape the 'parent' and 'ordering' parameters from the admin dashboard before using them in a SQL statement, leading to a SQL injection when adding a category...

WordPress SQL注入漏洞

WordPress is a set of blogging platforms developed using the PHP language by the Wordpress Foundation. The platform supports setting up personal blog sites on servers with PHP and MySQL. A SQL injection vulnerability exists in WordPress SpiderCatalog plugin 1.7.3 and earlier versions, which stems...

PT-2021-16143

Name of the Vulnerable Software and Affected Versions The G Auto-Hyperlink WordPress plugin versions 1.0.0 through 1.0.1 Description The issue is related to an authenticated SQL injection. The id GET parameter is not properly sanitized or escaped before being used in a SQL statement to select dat...

CVE-2021-24844: Improper Neutralization of Special Elements used in an SQL Command

The Affiliates Manager WordPress plugin before 2.8.7 does not validate the orderby parameter before using it in an SQL statement in the admin dashboard, leading to an SQL Injection issue...

Cross site scripting

The Request a Quote WordPress plugin before 2.3.9 does not sanitise, validate or escape some of its settings in the admin dashboard, leading to authenticated Stored Cross-Site Scripting issues even when the unfilteredhtml capability is disallowed...

CVE-2021-24489: Improper Neutralization of Input During Web Page Generation

The Request a Quote WordPress plugin before 2.3.9 does not sanitise, validate or escape some of its settings in the admin dashboard, leading to authenticated Stored Cross-Site Scripting issues even when the unfilteredhtml capability is disallowed...

Relevanssi - A Better Search < 4.14.3 - Unauthenticated Stored Cross-Site Scripting

The plugin does not sanitise and escape user searches before outputting them in the related admin dashboard when the feature is enabled PoC Enable the logging of user query, then was unauthenticated user /?s= The XSS will be triggered when an admin will view the User Searches dashboard at...

CVE-2021-24754

The MainWP Child Reports WordPress plugin before 2.0.8 does not validate or sanitise the order parameter before using it in a SQL statement in the admin dashboard, leading to an SQL injection issue...

Sql injection

The MainWP Child Reports WordPress plugin before 2.0.8 does not validate or sanitise the order parameter before using it in a SQL statement in the admin dashboard, leading to an SQL injection issue...

CVE-2021-24754

The MainWP Child Reports WordPress plugin before 2.0.8 does not validate or sanitise the order parameter before using it in a SQL statement in the admin dashboard, leading to an SQL injection issue...