6994 matches found
Cross site scripting
Unvalidated input and lack of output encoding in the WP Shieldon WordPress plugin, version 1.6.3 and below, leads to Unauthenticated Reflected Cross-Site Scripting XSS when the CAPTCHA page is shown could lead to privileged escalation...
CVE-2021-24139
Unvalidated input in the Photo Gallery 10Web Photo Gallery WordPress plugin, versions before 1.5.55, leads to SQL injection via the frontend/models/model.php bwgsearchx parameter...
Sql injection
Unvalidated input in the Ajax Load More WordPress plugin, versions before 5.3.2, lead to SQL Injection in POST /wp-admin/admin-ajax.php with param repeater=' or sleep5&type=test...
Sql injection
Unvalidated input in the AccessPress Social Icons plugin, versions before 1.8.1, did not sanitise its widget attribute, allowing accounts with post permission, such as author, to perform SQL injections...
CVE-2021-24136
Unvalidated input and lack of output encoding in the Testimonials Widget WordPress plugin, versions before 4.0.0, lead to multiple Cross-Site Scripting vulnerabilities, allowing remote attackers to inject arbitrary JavaScript code or HTML via the below parameters: - Author - Job Title - Location ...
Cross site scripting
Unvalidated input and lack of output encoding in the Themify Portfolio Post WordPress plugin, versions before 1.1.6, lead to Stored Cross-Site Scripting XSS vulnerabilities allowing low-privileged users Contributor+ to inject arbitrary JavaScript code or HTML in posts where the Themify Custom Pan...
CVE-2021-24149
CVE-2021-24149 affects WordPress plugin Modern Events Calendar Lite
CVE-2021-24147 Modern Events Calendar Lite < 5.16.5 - Authenticated Stored Cross-Site Scripting (XSS)
Unvalidated input and lack of output encoding in the Modern Events Calendar Lite WordPress plugin, versions before 5.16.5, did not sanitise the miccomment field Notes on time when adding/editing an event, allowing users with privilege as low as author to add events with a Cross-Site Scripting...
CVE-2021-24142 301 Redirects - Easy Redirect Manager < 2.51 - Authenticated SQL Injection
Unvaludated input in the 301 Redirects - Easy Redirect Manager WordPress plugin, versions before 2.51, did not sanitise its "Redirect From" column when importing a CSV file, allowing high privilege users to perform SQL injections...
CVE-2021-24143
AccessPress Social Icons for WordPress is vulnerable in all versions before 1.8.1 due to unvalidated, unsanitized widget attribute input, enabling authenticated users with post permissions (e.g., author) to perform SQL injections. Affected component: the plugin’s widget attribute handling. Verifi...
CVE-2021-24143 AccessPress Social Icons < 1.8.1 - Authenticated SQL Injection
Unvalidated input in the AccessPress Social Icons plugin, versions before 1.8.1, did not sanitise its widget attribute, allowing accounts with post permission, such as author, to perform SQL injections...
CVE-2021-24147
The CVE-2021-24147 entry concerns the WordPress plugin Modern Events Calendar Lite (pre-5.16.5). Affected component: mic_comment field in event creation/editing; root cause is unvalidated input and lack of output encoding, enabling Cross-Site Scripting when events are viewed. Impact is since low-...
CVE-2021-24144 Contact Form 7 Database Addon < 1.2.5.6 - CSV Injection
Unvalidated input in the Contact Form 7 Database Addon plugin, versions before 1.2.5.6, was prone to a vulnerability that lets remote attackers inject arbitrary formulas into CSV files...
CVE-2021-24135 WP Customer Reviews < 3.4.3 - Multiple Unauthenticated and Low Priv Authenticated Stored XSS
Unvalidated input and lack of output encoding in the WP Customer Reviews WordPress plugin, versions before 3.4.3, lead to multiple Stored Cross-Site Scripting vulnerabilities allowing remote attackers to inject arbitrary JavaScript code or HTML...
CVE-2021-24136 Testimonials Widget < 4.0.0 - Multiple Authenticated Stored XSS
Unvalidated input and lack of output encoding in the Testimonials Widget WordPress plugin, versions before 4.0.0, lead to multiple Cross-Site Scripting vulnerabilities, allowing remote attackers to inject arbitrary JavaScript code or HTML via the below parameters: - Author - Job Title - Location ...
CVE-2021-24140
The CVE-2021-24140 issue affects the WordPress plugin “Ajax Load More” (versions prior to 5.3.2). An unvalidated input path in POST /wp-admin/admin-ajax.php, via param repeater=' or sleep(5)# (and related payloads), enables SQL injection. Some sources note that exploitation requires authenticatio...
CVE-2021-24137
CVE-2021-24137 affects the WordPress Blog2Social plugin prior to 6.3.1. Unvalidated input in the Re-Share Posts feature allows authenticated users to perform SQL injection, enabling arbitrary SQL execution against the database. The vulnerability is exploitable via the plugin’s Re-Share Posts flow...
CVE-2021-24134 Constant Contact Forms < 1.8.8 - Multiple Authenticated Stored XSS
Unvalidated input and lack of output encoding in the Constant Contact Forms WordPress plugin, versions before 1.8.8, lead to multiple Stored Cross-Site Scripting vulnerabilities, which allowed high-privileged user Editor+ to inject arbitrary JavaScript code or HTML in posts where the malicious fo...
CVE-2021-24139 Photo Gallery by 10Web < 1.5.55 - Unauthenticated SQL Injection
Unvalidated input in the Photo Gallery 10Web Photo Gallery WordPress plugin, versions before 1.5.55, leads to SQL injection via the frontend/models/model.php bwgsearchx parameter...