PT-2021-15988

Name of the Vulnerable Software and Affected Versions Image Slider by Ays- Responsive Slider and Carousel WordPress plugin versions prior to 2.5.0 Description The issue concerns the get sliders function, which did not properly validate the orderby parameter before using it in SQL statements. This...

PT-2021-15958

Name of the Vulnerable Software and Affected Versions RSS for Yandex Turbo WordPress plugin versions 1.30 and earlier Description The issue is related to an Authenticated Stored Cross-Site Scripting problem. It occurs because some settings are not properly sanitised or escaped before being saved...

PT-2021-15983

Name of the Vulnerable Software and Affected Versions Popup box WordPress plugin versions prior to 2.3.4 Description The issue arises from the get ays popupboxes and get popup categories functions not validating the orderby parameter before using it in SQL statements, leading to SQL injection...

PT-2021-15987

Name of the Vulnerable Software and Affected Versions Photo Gallery by Ays – Responsive Image Gallery WordPress plugin versions prior to 4.4.4 Description The issue arises from the get gallery categories and get galleries functions not validating the orderby parameter before using it in SQL...

WordPress SQL注入漏洞

WordPress is a set of blogging platforms developed using the PHP language by the WordPress Wordpress Foundation. The platform supports setting up personal blog sites on servers with PHP and MySQL. A SQL injection vulnerability exists in WordPress plugin Ays- Responsive Slider and Carousel prior t...

WordPress SQL注入漏洞

WordPress is a set of blogging platforms developed using the PHP language by the WordPress Wordpress Foundation. The platform supports setting up personal blog sites on servers with PHP and MySQL. WordPress plugin Photo Gallery by Ays - Responsive Image Gallery A SQL injection vulnerability exist...

WordPress SQL注入漏洞

WordPress is a set of blogging platforms developed using the PHP language by the WordPress Wordpress Foundation. The platform supports setting up personal blog sites on servers with PHP and MySQL. A SQL injection vulnerability exists in the WordPress plugin FAQ Builder AYS prior to version 1.3.6,...

WordPress SQL注入漏洞

WordPress is a set of blogging platforms developed using the PHP language by the WordPress Wordpress Foundation. The platform supports setting up personal blog sites on servers with PHP and MySQL. A SQL injection vulnerability exists in the WordPress plugin Portfolio Responsive Gallery prior to...

WordPress SQL注入漏洞

WordPress is a set of blogging platforms developed using the PHP language by the WordPress Wordpress Foundation. The platform supports setting up personal blog sites on servers with PHP and MySQL. A SQL injection vulnerability exists in the WordPress plugin Popup box prior to version 2.3.4, which...

CVE-2021-24462: Improper Neutralization of Special Elements used in an SQL Command

The getgallerycategories and getgalleries functions in the Photo Gallery by Ays – Responsive Image Gallery WordPress plugin before 4.4.4 did not use whitelist or validate the orderby parameter before using it in SQL statements passed to the getresults DB calls, leading to SQL injection issues in...

CVE-2021-24457: Improper Neutralization of Special Elements used in an SQL Command

The getportfolios and getportfolioattributes functions in the class-portfolio-responsive-gallery-list-table.php and class-portfolio-responsive-gallery-attributes-list-table.php files of the Portfolio Responsive Gallery WordPress plugin before 1.1.8 did not use whitelist or validate the orderby...

CVE-2021-24456: Improper Neutralization of Special Elements used in an SQL Command

The Quiz Maker WordPress plugin before 6.2.0.9 did not properly sanitise and escape the order and orderby parameters before using them in SQL statements, leading to SQL injection issues in the admin dashboard...

CVE-2021-24428: Improper Neutralization of Input During Web Page Generation

The RSS for Yandex Turbo WordPress plugin through 1.30 does not sanitise or escape some of its settings before saving and outputing them in the admin dashboard, leading to an Authenticated Stored Cross-Site Scripting issue even when the unfilteredhtml capability is disallowed...

WordPress和WordPress 插件 SQL注入漏洞

WordPress is a blogging platform developed by the Wordpress Foundation using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.Secure Copy Content Protection plugin is an application plugin for WordPress. A SQL injection vulnerability exists in...

PT-2021-16007

Name of the Vulnerable Software and Affected Versions Secure Copy Content Protection and Content Locking WordPress plugin versions prior to 2.6.7 Description The issue arises from the get reports function not validating the orderby parameter before using it in SQL statements, leading to SQL...

PT-2021-15982

Name of the Vulnerable Software and Affected Versions The Quiz Maker versions prior to 6.2.0.9 Description The issue arises from improper sanitization and escaping of the order and orderby parameters before their use in SQL statements, leading to SQL injection issues in the admin dashboard...

CVE-2021-24484: Improper Neutralization of Special Elements used in an SQL Command

The getreports function in the Secure Copy Content Protection and Content Locking WordPress plugin before 2.6.7 did not use whitelist or validate the orderby parameter before using it in SQL statements passed to the getresults DB calls, leading to SQL injection issues in the admin dashboard...

CVE-2021-24461: Improper Neutralization of Special Elements used in an SQL Command

The getfaqs function in the FAQ Builder AYS WordPress plugin before 1.3.6 did not use whitelist or validate the orderby parameter before using it in SQL statements passed to the getresults DB calls, leading to SQL injection issues in the admin dashboard...

WordPress SQL注入漏洞

WordPress is a set of blogging platforms developed using the PHP language by the WordPress Wordpress Foundation. The platform supports setting up personal blog sites on servers with PHP and MySQL. A SQL injection vulnerability exists in WordPress Popup Like box - Page Plugin prior to version 3.5....

WordPress SQL注入漏洞

WordPress is a set of blogging platform developed by Wordpress Foundation using PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.Quiz Maker plugin is an application plugin for WordPress. A SQL injection vulnerability exists in WordPress Quiz Maker...