Total
41364 CVE
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2021-24673 | 1 Dwbooster | 1 Appointment Hour Booking | 2024-11-21 | 4.8 Medium |
| The Appointment Hour Booking WordPress plugin before 1.3.16 does not escape some of the Calendar Form settings, allowing high privilege users to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed. | ||||
| CVE-2021-24672 | 1 Onedesigns | 1 One User Avatar | 2024-11-21 | 5.4 Medium |
| The One User Avatar WordPress plugin before 2.3.7 does not escape the link and target attributes of its shortcode, allowing users with a role as low as Contributor to perform Stored Cross-Site Scripting attacks | ||||
| CVE-2021-24671 | 1 Mx Time Zone Clocks Project | 1 Mx Time Zone Clocks | 2024-11-21 | 5.4 Medium |
| The MX Time Zone Clocks WordPress plugin before 3.4.1 does not escape the time_zone attribute of the mxmtzc_time_zone_clocks shortcode, allowing users with a role as low as Contributor to perform Stored Cross-Site Scripting attacks | ||||
| CVE-2021-24670 | 1 Status301 | 1 Coolclock | 2024-11-21 | 5.4 Medium |
| The CoolClock WordPress plugin before 4.3.5 does not escape some shortcode attributes, allowing users with a role as low as Contributor toperform Stored Cross-Site Scripting attacks | ||||
| CVE-2021-24667 | 1 Simplygallery | 1 Simply Gallery Blocks With Lightbox | 2024-11-21 | 5.4 Medium |
| A stored cross-site scripting vulnerability has been discovered in : Simply Gallery Blocks with Lightbox (Version – 2.2.0 & below). The vulnerability exists in the Lightbox functionality where a user with low privileges is allowed to execute arbitrary script code within the context of the application. This vulnerability is due to insufficient validation of image parameters in meta data. | ||||
| CVE-2021-24665 | 1 Tipsandtricks-hq | 1 Wp Video Lightbox | 2024-11-21 | 5.4 Medium |
| The WP Video Lightbox WordPress plugin before 1.9.3 does not escape the attributes of its shortcodes, allowing users with a role as low as contributor to perform Cross-Site Scripting attacks | ||||
| CVE-2021-24664 | 1 Igexsolutions | 1 Wpschoolpress | 2024-11-21 | 4.8 Medium |
| The School Management System – WPSchoolPress WordPress plugin before 2.1.17 sanitise some fields using sanitize_text_field() but does not escape them before outputting in attributes, resulting in Stored Cross-Site Scripting issues. | ||||
| CVE-2021-24660 | 1 Wpxpo | 1 Postx - Gutenberg Blocks For Post Grid | 2024-11-21 | 5.4 Medium |
| The PostX – Gutenberg Blocks for Post Grid WordPress plugin before 2.4.10, with Saved Templates Addon enabled, allows users with a role as low as Contributor to perform Stored Cross-Site Scripting attacks via the plugin's shortcode. | ||||
| CVE-2021-24659 | 1 Wpxpo | 1 Postx - Gutenberg Blocks For Post Grid | 2024-11-21 | 5.4 Medium |
| The PostX – Gutenberg Blocks for Post Grid WordPress plugin before 2.4.10 allows users with a role as low as Contributor to perform Stored Cross-Site Scripting attacks via the plugin's block. | ||||
| CVE-2021-24658 | 1 Erident Custom Login And Dashboard Project | 1 Erident Custom Login And Dashboard | 2024-11-21 | 4.8 Medium |
| The Erident Custom Login and Dashboard WordPress plugin before 3.5.9 did not properly sanitise its settings, allowing high privilege users to use XSS payloads in them (even when the unfileted_html is disabled) | ||||
| CVE-2021-24657 | 1 Limit Login Attempts Project | 1 Limit Login Attempts | 2024-11-21 | 6.1 Medium |
| The Limit Login Attempts WordPress plugin before 4.0.50 does not escape the IP addresses (which can be controlled by attacker via headers such as X-Forwarded-For) of attempted logins before outputting them in the reports table, leading to an Unauthenticated Stored Cross-Site Scripting issue. | ||||
| CVE-2021-24656 | 1 Wpbrigade | 1 Simple Social Buttons | 2024-11-21 | 4.8 Medium |
| The Simple Social Media Share Buttons WordPress plugin before 3.2.4 does not escape the Share Title settings before outputting it in the frontend pages or posts (depending on the settings used), allowing high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed. | ||||
| CVE-2021-24654 | 1 Wpeverest | 1 User Registration | 2024-11-21 | 5.4 Medium |
| The User Registration WordPress plugin before 2.0.2 does not properly sanitise the user_registration_profile_pic_url value when submitted directly via the user_registration_update_profile_details AJAX action. This could allow any authenticated user, such as subscriber, to perform Stored Cross-Site attacks when their profile is viewed | ||||
| CVE-2021-24653 | 1 Cookie-bar Project | 1 Cookie-bar | 2024-11-21 | 4.8 Medium |
| The Cookie Bar WordPress plugin before 1.8.9 doesn't properly sanitise the Cookie Bar Message setting, which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed | ||||
| CVE-2021-24648 | 1 Metagauss | 1 Registrationmagic | 2024-11-21 | 6.1 Medium |
| The RegistrationMagic WordPress plugin before 5.0.1.9 does not sanitise and escape the rm_search_value parameter before outputting back in an attribute, leading to a Reflected Cross-Site Scripting | ||||
| CVE-2021-24646 | 1 Bookingholdings | 1 Booking.com Banner Creator | 2024-11-21 | 4.8 Medium |
| The Booking.com Banner Creator WordPress plugin before 1.4.3 does not properly sanitize inputs when creating banners, which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed | ||||
| CVE-2021-24645 | 1 Bookingholdings | 1 Booking.com Product Helper | 2024-11-21 | 4.8 Medium |
| The Booking.com Product Helper WordPress plugin before 1.0.2 does not sanitize and escape Product Code when creating Product Shortcode, which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed | ||||
| CVE-2021-24643 | 1 Wp Map Block Project | 1 Wp Map Block | 2024-11-21 | 5.4 Medium |
| The WP Map Block WordPress plugin before 1.2.3 does not escape some attributes of the WP Map Block, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks | ||||
| CVE-2021-24642 | 1 Scroll Banner Project | 1 Scroll Banner | 2024-11-21 | 6.5 Medium |
| The Scroll Baner WordPress plugin through 1.0 does not have CSRF check in place when saving its settings, nor perform any sanitisation, escaping or validation on them. This could allow attackers to make logged in admin change them and could lead to RCE (via a file upload) as well as XSS | ||||
| CVE-2021-24640 | 1 Gutenslider | 1 Gutenslider | 2024-11-21 | 5.4 Medium |
| The WordPress Slider Block Gutenslider plugin before 5.2.0 does not escape the minWidth attribute of a Gutenburg block, which could allow users with a role as low as contributor to perform Cross-Site Scripting attacks | ||||