CVE-2021-24906

The CVE-2021-24906 entry concerns the WordPress Protect WP Admin plugin (pre-3.6.2). The vulnerability is an unauthenticated deactivation in lib/pwa-deactivate.php due to missing authorization checks, allowing an unauthenticated attacker to disable the plugin and its protection via a crafted requ...

WordPress plugin 访问控制错误漏洞

WordPress is the WordPress Foundation's suite of blogging platforms developed using the PHP language. The platform supports the hosting of personal blogging sites on servers with PHP and MySQL. An access control error vulnerability exists in versions of Wordpress Plugin Protect WP Admin prior to...

CVE-2021-24906: Missing Authorization

The Protect WP Admin WordPress plugin before 3.6.2 does not check for authorisation in the lib/pwa-deactivate.php file, which could allow unauthenticated users to disable the plugin and therefore the protection offered via a crafted request...

WordPress Protect WP Admin plugin <= 3.6 - Unauthenticated Plugin Deactivation vulnerability

Unauthenticated Plugin Deactivation vulnerability discovered by Krzysztof Zając in WordPress Protect WP Admin plugin versions = 3.6. Solution Update the WordPress Protect WP Admin plugin to the latest available version at least 3.6.2...

CVE-2021-24784

The WP Admin Logo Changer WordPress plugin through 1.0 does not have CSRF check when saving its settings, which could allow attackers to make a logged in admin update them via a CSRF attack...

CVE-2021-24784 WP Admin Logo Changer <= 1.0 - Plugin's Settings Update via CSRF

The WP Admin Logo Changer WordPress plugin through 1.0 does not have CSRF check when saving its settings, which could allow attackers to make a logged in admin update them via a CSRF attack...

CVE-2021-24784

The CVE concerns the WordPress plugin “WP Admin Logo Changer” (versions

PT-2021-16279

Name of the Vulnerable Software and Affected Versions: WP Admin Logo Changer WordPress plugin versions 1.0 and earlier Description: The issue concerns a lack of CSRF check when saving settings, which could allow attackers to make a logged-in admin update them via a CSRF attack. Recommendations: F...

CVE-2021-24784: Cross-Site Request Forgery (CSRF)

The WP Admin Logo Changer WordPress plugin through 1.0 does not have CSRF check when saving its settings, which could allow attackers to make a logged in admin update them via a CSRF attack...

Rich Reviews by Starfish < 1.9.6 - Admin+ SQL Injection

The plugin does not properly validate the orderby GET parameter of the pending reviews page before using it in a SQL statement, leading to an authenticated SQL injection issue error-based SQLI: orderby=id AND EXTRACTVALUE4795,CONCAT0x5c,0x717a627871,SELECT ELT4795=4795,1,0x7176707071 time-based...

WP Admin Logo Changer <= 1.0 - Plugin's Settings Update via CSRF

The plugin does not have CSRF check when saving its settings, which could allow attackers to make a logged in admin update them via a CSRF attack. csrf.submit...

CVE-2021-24716

The Modern Events Calendar Lite WordPress plugin before 5.22.3 does not properly sanitize or escape values set by users with access to adjust settings withing wp-admin...

Design/Logic Flaw

The WP Reactions Lite WordPress plugin before 1.3.6 does not properly sanitize inputs within wp-admin pages, allowing users with sufficient access to inject XSS payloads within /wp-admin/ pages...

CVE-2021-24723

The WP Reactions Lite WordPress plugin before 1.3.6 does not properly sanitize inputs within wp-admin pages, allowing users with sufficient access to inject XSS payloads within /wp-admin/ pages...

CVE-2021-24723 WP Reactions Lite < 1.3.6 - Authenticated Stored Cross Site Scripting

The WP Reactions Lite WordPress plugin before 1.3.6 does not properly sanitize inputs within wp-admin pages, allowing users with sufficient access to inject XSS payloads within /wp-admin/ pages...

PT-2021-16219

Name of the Vulnerable Software and Affected Versions The Modern Events Calendar Lite WordPress plugin versions prior to 5.22.3 Description The issue arises from the plugin's failure to properly sanitize or escape values set by users with access to adjust settings within wp-admin. This could...

PT-2021-16226

Name of the Vulnerable Software and Affected Versions WP Reactions Lite WordPress plugin versions prior to 1.3.6 Description The issue allows users with sufficient access to inject XSS payloads within /wp-admin/ pages due to improper input sanitization within wp-admin pages. Recommendations For W...

CVE-2021-24723: Improper Neutralization of Input During Web Page Generation

The WP Reactions Lite WordPress plugin before 1.3.6 does not properly sanitize inputs within wp-admin pages, allowing users with sufficient access to inject XSS payloads within /wp-admin/ pages...

CVE-2021-24716: Improper Neutralization of Input During Web Page Generation

The Modern Events Calendar Lite WordPress plugin before 5.22.3 does not properly sanitize or escape values set by users with access to adjust settings withing wp-admin...

Forminator < 1.15.4 - Admin+ Stored Cross-Site Scripting

The plugin does not sanitize and escape the email field label, which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfilteredhtml is disallowed PoC As an admin, create or edit a Forminator form, add an email field and put the following payload in the label...