CVE-2021-24137

CVE-2021-24137 affects the WordPress Blog2Social plugin prior to 6.3.1. Unvalidated input in the Re-Share Posts feature allows authenticated users to perform SQL injection, enabling arbitrary SQL execution against the database. The vulnerability is exploitable via the plugin’s Re-Share Posts flow...

CVE-2021-24141 Advanced Database Cleaner < 3.0.2 - Authenticated SQL injection

Unvaludated input in the Advanced Database Cleaner plugin, versions before 3.0.2, lead to SQL injection allowing high privilege users admin+ to perform SQL attacks...

CVE-2021-24135 WP Customer Reviews < 3.4.3 - Multiple Unauthenticated and Low Priv Authenticated Stored XSS

Unvalidated input and lack of output encoding in the WP Customer Reviews WordPress plugin, versions before 3.4.3, lead to multiple Stored Cross-Site Scripting vulnerabilities allowing remote attackers to inject arbitrary JavaScript code or HTML...

CVE-2021-24136 Testimonials Widget < 4.0.0 - Multiple Authenticated Stored XSS

Unvalidated input and lack of output encoding in the Testimonials Widget WordPress plugin, versions before 4.0.0, lead to multiple Cross-Site Scripting vulnerabilities, allowing remote attackers to inject arbitrary JavaScript code or HTML via the below parameters: - Author - Job Title - Location ...

CVE-2021-24140

The CVE-2021-24140 issue affects the WordPress plugin “Ajax Load More” (versions prior to 5.3.2). An unvalidated input path in POST /wp-admin/admin-ajax.php, via param repeater=' or sleep(5)# (and related payloads), enables SQL injection. Some sources note that exploitation requires authenticatio...

CVE-2021-24134 Constant Contact Forms < 1.8.8 - Multiple Authenticated Stored XSS

Unvalidated input and lack of output encoding in the Constant Contact Forms WordPress plugin, versions before 1.8.8, lead to multiple Stored Cross-Site Scripting vulnerabilities, which allowed high-privileged user Editor+ to inject arbitrary JavaScript code or HTML in posts where the malicious fo...

CVE-2021-24130 WP Google Map Plugin < 4.1.5 - Authenticated SQL Injection

Unvalidated input in the WP Google Map Plugin WordPress plugin, versions before 4.1.5, in the Manage Locations page within the plugin settings was vulnerable to SQL Injection through a high privileged user admin+...

CVE-2021-24126

The CVE-2021-24126 entry concerns the Envira Gallery Lite WordPress plugin (versions before 1.8.3.3). The issue arises from unvalidated input and a lack of output encoding when sanitising image metadata (specifically the title) before it is rendered in the generated gallery. This handling is desc...

CVE-2021-24124

Affected software: WordPress WP Shieldon plugin (versions 1.6.3 and below). Vulnerability: Unauthenticated Reflected Cross‑Site Scripting caused by unvalidated input and lack of output encoding on the CAPTCHA page, due to $_SERVER['REQUEST_URI'] being echoed without encoding. Impact: could lead t...

CVE-2021-24129 Themify Portfolio Post < 1.1.6 - Authenticated Stored Cross-Site Scripting

Unvalidated input and lack of output encoding in the Themify Portfolio Post WordPress plugin, versions before 1.1.6, lead to Stored Cross-Site Scripting XSS vulnerabilities allowing low-privileged users Contributor+ to inject arbitrary JavaScript code or HTML in posts where the Themify Custom Pan...

CVE-2021-24128 Team Members < 5.0.4 - Authenticated Stored Cross-Site Scripting (XSS)

Unvalidated input and lack of output encoding in the Team Members WordPress plugin, versions before 5.0.4, lead to Cross-site scripting vulnerabilities allowing medium-privileged authenticated attacker contributor+ to inject arbitrary web script or HTML via the 'Description/biography' of a member...

CVE-2021-24124 WP Shieldon 1.6.3 - Unauthenticated Cross-Site Scripting (XSS)

Unvalidated input and lack of output encoding in the WP Shieldon WordPress plugin, version 1.6.3 and below, leads to Unauthenticated Reflected Cross-Site Scripting XSS when the CAPTCHA page is shown could lead to privileged escalation...

CVE-2021-24125 Contact Form Submissions < 1.7.1 - Authenticated SQL Injection

Unvalidated input in the Contact Form Submissions WordPress plugin before 1.7.1, could lead to SQL injection in the wpcf7contactform GET parameter when submitting a filter request as a high privilege user admin+...

CVE-2021-24128

WordPress Team Members plugin vulnerability CVE-2021-24128 affects versions before 5.0.4. The issue is unvalidated input and lack of output encoding in the Description/biography field, enabling an authenticated, medium-privileged attacker (contributor+) to inject arbitrary web script or HTML (sto...

CVE-2021-24131 Anti-Spam by CleanTalk < 5.149 - Multiple Authenticated SQL Injections

Unvalidated input in the Anti-Spam by CleanTalk WordPress plugin, versions before 5.149, lead to multiple authenticated SQL injection vulnerabilities, however, it requires high privilege user admin+...

CVE-2021-24130

CVE-2021-24130 describes an SQL injection in the WordPress WP Google Map Plugin prior to 4.1.5, via unvalidated input on the Manage Locations page. The vulnerability requires a high-privileged user (admin+) to trigger it and can lead to exposure of sensitive database information. Affected softwar...

PT-2021-15690 · WordPress · Contact Form 7 Database Addon

Name of the Vulnerable Software and Affected Versions: Contact Form 7 Database Addon plugin versions prior to 1.2.5.6 Description: The issue concerns unvalidated input in the Contact Form 7 Database Addon plugin, allowing remote attackers to inject arbitrary formulas into CSV files...

Wordpress Slider by 10Web SQL注入漏洞

Wordpress Slider by 10Web is an open source application plugin for Wordpress. Provides a versatile solution for adding a fast loading, responsive and SEO friendly slider to website pages, posts, theme headers or any other location. Slider by 10Web WordPress plugin versions prior to 1.2.36 suffers...

Related Posts for WordPress < 2.0.4 - Authenticated Reflected Cross-Site Scripting (XSS)

Unvalidated input and lack of output encoding within the plugin lead to a Reflected Cross-Site Scripting XSS vulnerability within the 'lang' GET parameter while editing a post, triggered when users with the capability of editing posts access a malicious URL. PoC /wp-admin/post.php?post=1=edit〈='...

Authentication Bypass

botframework-connector is vulnerable to authentication bypass. The vulnerability exists as Skill claims found in the jwt token is not validated against the SkillValidation.isSkillClaim method...