CVE-2021-24459

The getresults and getitems functions in the Survey Maker WordPress plugin before 1.5.6 did not use whitelist or validate the orderby parameter before using it in SQL statements passed to the getresults DB calls, leading to SQL injection issues in the admin dashboard...

CVE-2021-24463

The getsliders function in the Image Slider by Ays- Responsive Slider and Carousel WordPress plugin before 2.5.0 did not use whitelist or validate the orderby parameter before using it in SQL statements passed to the getresults DB calls, leading to SQL injection issues in the admin dashboard...

CVE-2021-24462

The getgallerycategories and getgalleries functions in the Photo Gallery by Ays – Responsive Image Gallery WordPress plugin before 4.4.4 did not use whitelist or validate the orderby parameter before using it in SQL statements passed to the getresults DB calls, leading to SQL injection issues in...

CVE-2021-24457

The getportfolios and getportfolioattributes functions in the class-portfolio-responsive-gallery-list-table.php and class-portfolio-responsive-gallery-attributes-list-table.php files of the Portfolio Responsive Gallery WordPress plugin before 1.1.8 did not use whitelist or validate the orderby...

CVE-2021-24458

The getayspopupboxes and getpopupcategories functions of the Popup box WordPress plugin before 2.3.4 did not use whitelist or validate the orderby parameter before using it in SQL statements passed to the getresults DB calls, leading to SQL injection issues in the admin dashboard...

CVE-2021-24484

The getreports function in the Secure Copy Content Protection and Content Locking WordPress plugin before 2.6.7 did not use whitelist or validate the orderby parameter before using it in SQL statements passed to the getresults DB calls, leading to SQL injection issues in the admin dashboard...

CVE-2021-24456

The Quiz Maker WordPress plugin before 6.2.0.9 did not properly sanitise and escape the order and orderby parameters before using them in SQL statements, leading to SQL injection issues in the admin dashboard...

PT-2021-15983

Name of the Vulnerable Software and Affected Versions Popup box WordPress plugin versions prior to 2.3.4 Description The issue arises from the get ays popupboxes and get popup categories functions not validating the orderby parameter before using it in SQL statements, leading to SQL injection...

PT-2021-16006

Name of the Vulnerable Software and Affected Versions Poll Maker WordPress plugin versions prior to 3.2.1 Description The issue concerns the get poll categories, get polls, and get reports functions, which did not properly validate the orderby parameter before using it in SQL statements. This...

PT-2021-15982

Name of the Vulnerable Software and Affected Versions The Quiz Maker versions prior to 6.2.0.9 Description The issue arises from improper sanitization and escaping of the order and orderby parameters before their use in SQL statements, leading to SQL injection issues in the admin dashboard...

PT-2021-15986

Name of the Vulnerable Software and Affected Versions FAQ Builder AYS WordPress plugin versions prior to 1.3.6 Description The issue concerns the get faqs function, which did not properly validate the orderby parameter before using it in SQL statements. This oversight led to SQL injection issues ...

PT-2021-15985

Name of the Vulnerable Software and Affected Versions Popup Like box – Page Plugin WordPress plugin versions prior to 3.5.3 Description The issue arises from the get fb likeboxes function not validating the orderby parameter before using it in SQL statements, leading to SQL injection issues in th...

PT-2021-16007

Name of the Vulnerable Software and Affected Versions Secure Copy Content Protection and Content Locking WordPress plugin versions prior to 2.6.7 Description The issue arises from the get reports function not validating the orderby parameter before using it in SQL statements, leading to SQL...

CVE-2021-24457: Improper Neutralization of Special Elements used in an SQL Command

The getportfolios and getportfolioattributes functions in the class-portfolio-responsive-gallery-list-table.php and class-portfolio-responsive-gallery-attributes-list-table.php files of the Portfolio Responsive Gallery WordPress plugin before 1.1.8 did not use whitelist or validate the orderby...

PT-2021-15987

Name of the Vulnerable Software and Affected Versions Photo Gallery by Ays – Responsive Image Gallery WordPress plugin versions prior to 4.4.4 Description The issue arises from the get gallery categories and get galleries functions not validating the orderby parameter before using it in SQL...

PT-2021-15988

Name of the Vulnerable Software and Affected Versions Image Slider by Ays- Responsive Slider and Carousel WordPress plugin versions prior to 2.5.0 Description The issue concerns the get sliders function, which did not properly validate the orderby parameter before using it in SQL statements. This...

PT-2021-15984

Name of the Vulnerable Software and Affected Versions Survey Maker WordPress plugin versions prior to 1.5.6 Description The issue arises from the get results and get items functions not properly validating the orderby parameter before using it in SQL statements, leading to SQL injection issues in...

CVE-2021-24483: Improper Neutralization of Special Elements used in an SQL Command

The getpollcategories, getpolls and getreports functions in the Poll Maker WordPress plugin before 3.2.1 did not use whitelist or validate the orderby parameter before using it in SQL statements passed to the getresults DB calls, leading to SQL injection issues in the admin dashboard...

CVE-2021-24461: Improper Neutralization of Special Elements used in an SQL Command

The getfaqs function in the FAQ Builder AYS WordPress plugin before 1.3.6 did not use whitelist or validate the orderby parameter before using it in SQL statements passed to the getresults DB calls, leading to SQL injection issues in the admin dashboard...

CVE-2021-24459: Improper Neutralization of Special Elements used in an SQL Command

The getresults and getitems functions in the Survey Maker WordPress plugin before 1.5.6 did not use whitelist or validate the orderby parameter before using it in SQL statements passed to the getresults DB calls, leading to SQL injection issues in the admin dashboard...