CVE-2021-24568: Improper Neutralization of Input During Web Page Generation

The AddToAny Share Buttons WordPress plugin before 1.7.46 does not sanitise its Sharing Header setting when outputting it in frontend pages, allowing high privilege users such as admin to perform Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed...

PT-2021-16039

Name of the Vulnerable Software and Affected Versions The Stop Spammers Security | Block Spam Users, Comments, Forms WordPress plugin versions prior to 2021.18 Description The issue allows high privilege users, such as admins, to set Cross-Site Scripting payloads in some settings, even when the...

PT-2021-16116

Name of the Vulnerable Software and Affected Versions WPFront Notification Bar WordPress plugin version 2.1.0.08087 and earlier Description The issue arises from the plugin's failure to properly sanitise and escape its settings. This could allow high privilege users to perform Cross-Site Scriptin...

PT-2021-16106

Name of the Vulnerable Software and Affected Versions Highlight WordPress plugin versions prior to 0.9.3 Description The issue allows high privilege users to perform Cross-Site Scripting attacks due to the lack of sanitization in the CustomCSS setting, even when the unfiltered html capability is...

CVE-2021-24513: Improper Neutralization of Input During Web Page Generation

The Form Builder | Create Responsive Contact Forms WordPress plugin before 1.9.8.4 does not sanitise or escape its Form Title, allowing high privilege users such as admin to set Cross-Site Scripting payload in them, even when the unfilteredhtml capability is disallowed...

CVE-2021-24591: Improper Neutralization of Input During Web Page Generation

The Highlight WordPress plugin before 0.9.3 does not sanitise its CustomCSS setting, allowing high privilege users to perform Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed...

PT-2021-6441 · Oracle +1 · Mysql Cluster +1

Name of the Vulnerable Software and Affected Versions: MySQL Cluster versions 7.4.34 and prior MySQL Cluster versions 7.5.24 and prior MySQL Cluster versions 7.6.20 and prior MySQL Cluster versions 8.0.27 and prior Description: The issue allows a high-privileged attacker with access to the physic...

CVE-2021-24592

The Sitewide Notice WP WordPress plugin before 2.3 does not sanitise some of its settings before outputting them in frontend pages, allowing high privilege users to perform Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed...

Cross site scripting

The Sitewide Notice WP WordPress plugin before 2.3 does not sanitise some of its settings before outputting them in frontend pages, allowing high privilege users to perform Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed...

CVE-2021-24592: Improper Neutralization of Input During Web Page Generation

The Sitewide Notice WP WordPress plugin before 2.3 does not sanitise some of its settings before outputting them in frontend pages, allowing high privilege users to perform Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed...

Cross-Site Request Forgery (CSRF) in combodo/itop

✍️ Description Attacker able to delete Standard SLA with CSRF attack. It does not matter at all that your application run in localhost or elsewhere, just it is enough to run on a browser and another low privilege user or attackers know the IP address or hostname of your application. In CSRF attack...

TextME SMS < 1.8.9 - Authenticated Stored XSS

The plugin does not escape its settings when outputting them, allowing high privilege users to perform XSS attacks even when the unfilteredhtml capability is disallowed PoC Put the following payload in the Account Username or Password settings of the plugin: " style=animation-name:rotation...

CVE-2021-24549

The AceIDE WordPress plugin through 2.6.2 does not sanitise or validate the user input which is appended to system paths before using it in various actions, such as to read arbitrary files from the server. This allows high privilege users such as administrator to access any file on the web server...

CVE-2021-24524

The GiveWP – Donation Plugin and Fundraising Platform WordPress plugin before 2.12.0 did not escape the Donation Level setting of its Donation Forms, allowing high privilege users to use Cross-Site Scripting payloads in them...

CVE-2021-24549

The AceIDE WordPress plugin through 2.6.2 does not sanitise or validate the user input which is appended to system paths before using it in various actions, such as to read arbitrary files from the server. This allows high privilege users such as administrator to access any file on the web server...

Design/Logic Flaw

The Erident Custom Login and Dashboard WordPress plugin before 3.5.9 did not properly sanitise its settings, allowing high privilege users to use XSS payloads in them even when the unfiletedhtml is disabled...

CVE-2021-24658

The Erident Custom Login and Dashboard WordPress plugin before 3.5.9 did not properly sanitise its settings, allowing high privilege users to use XSS payloads in them even when the unfiletedhtml is disabled...

Path traversal

The AceIDE WordPress plugin through 2.6.2 does not sanitise or validate the user input which is appended to system paths before using it in various actions, such as to read arbitrary files from the server. This allows high privilege users such as administrator to access any file on the web server...

PT-2021-16046

Name of the Vulnerable Software and Affected Versions GiveWP – Donation Plugin and Fundraising Platform versions prior to 2.12.0 Description The issue allows high privilege users to use Cross-Site Scripting payloads in the Donation Level setting of its Donation Forms due to a lack of proper...

PT-2021-16054

Name of the Vulnerable Software and Affected Versions Maintenance WordPress plugin versions prior to 4.03 Description The issue allows high privilege users, such as admins, to inject Cross-Site Scripting payload in some of the plugin's settings, even when the unfiltered html capability is...