Total
37253 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2021-24653 | 1 Cookie-bar Project | 1 Cookie-bar | 2024-11-21 | 3.5 LOW | 4.8 MEDIUM |
| The Cookie Bar WordPress plugin before 1.8.9 doesn't properly sanitise the Cookie Bar Message setting, which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed | |||||
| CVE-2021-24648 | 1 Metagauss | 1 Registrationmagic | 2024-11-21 | 4.3 MEDIUM | 6.1 MEDIUM |
| The RegistrationMagic WordPress plugin before 5.0.1.9 does not sanitise and escape the rm_search_value parameter before outputting back in an attribute, leading to a Reflected Cross-Site Scripting | |||||
| CVE-2021-24646 | 1 Bookingholdings | 1 Booking.com Banner Creator | 2024-11-21 | 3.5 LOW | 4.8 MEDIUM |
| The Booking.com Banner Creator WordPress plugin before 1.4.3 does not properly sanitize inputs when creating banners, which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed | |||||
| CVE-2021-24645 | 1 Bookingholdings | 1 Booking.com Product Helper | 2024-11-21 | 3.5 LOW | 4.8 MEDIUM |
| The Booking.com Product Helper WordPress plugin before 1.0.2 does not sanitize and escape Product Code when creating Product Shortcode, which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed | |||||
| CVE-2021-24643 | 1 Wp Map Block Project | 1 Wp Map Block | 2024-11-21 | 3.5 LOW | 5.4 MEDIUM |
| The WP Map Block WordPress plugin before 1.2.3 does not escape some attributes of the WP Map Block, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks | |||||
| CVE-2021-24642 | 1 Scroll Banner Project | 1 Scroll Banner | 2024-11-21 | 4.3 MEDIUM | 6.5 MEDIUM |
| The Scroll Baner WordPress plugin through 1.0 does not have CSRF check in place when saving its settings, nor perform any sanitisation, escaping or validation on them. This could allow attackers to make logged in admin change them and could lead to RCE (via a file upload) as well as XSS | |||||
| CVE-2021-24640 | 1 Gutenslider | 1 Gutenslider | 2024-11-21 | 3.5 LOW | 5.4 MEDIUM |
| The WordPress Slider Block Gutenslider plugin before 5.2.0 does not escape the minWidth attribute of a Gutenburg block, which could allow users with a role as low as contributor to perform Cross-Site Scripting attacks | |||||
| CVE-2021-24637 | 1 Fontsplugin | 1 Fonts | 2024-11-21 | 3.5 LOW | 5.4 MEDIUM |
| The Google Fonts Typography WordPress plugin before 3.0.3 does not escape and sanitise some of its block settings, allowing users with as role as low as Contributor to perform Stored Cross-Site Scripting attacks via blockType (combined with content), align, color, variant and fontID argument of a Gutenberg block. | |||||
| CVE-2021-24634 | 1 Wpzoom | 1 Recipe Card Blocks For Gutenberg \& Elementor | 2024-11-21 | 3.5 LOW | 5.4 MEDIUM |
| The Recipe Card Blocks by WPZOOM WordPress plugin before 2.8.3 does not properly sanitise or escape some of the properties of the Recipe Card Block (such as ingredientsLayout, iconSet, steps, ingredients, recipeTitle, or settings), which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks. | |||||
| CVE-2021-24632 | 1 Wpzoom | 1 Recipe Card Blocks For Gutenberg \& Elementor | 2024-11-21 | 4.3 MEDIUM | 6.1 MEDIUM |
| The Recipe Card Blocks by WPZOOM WordPress plugin before 2.8.1 does not escape the message parameter before outputting it back in the admin dashboard, leading to a Reflected Cross-Site Scripting issue | |||||
| CVE-2021-24624 | 1 Sonaar | 1 Mp3 Audio Player For Music\, Radio \& Podcast | 2024-11-21 | 3.5 LOW | 4.8 MEDIUM |
| The MP3 Audio Player for Music, Radio & Podcast by Sonaar WordPress plugin before 2.4.2 does not properly sanitize or escape data in some of its Playlist settings, allowing high privilege users to perform Cross-Site Scripting attacks | |||||
| CVE-2021-24623 | 1 Ticket-system | 1 Wordpress Advanced Ticket System | 2024-11-21 | 3.5 LOW | 4.8 MEDIUM |
| The WordPress Advanced Ticket System, Elite Support Helpdesk WordPress plugin before 1.0.64 does not sanitize or escape form values before saving to the database or when outputting, which allows high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed. | |||||
| CVE-2021-24622 | 1 Emarketdesign | 1 Customer Service Software \& Support Ticket System | 2024-11-21 | 3.5 LOW | 4.8 MEDIUM |
| The Customer Service Software & Support Ticket System WordPress plugin before 5.10.4 does not sanitize or escape form fields before outputting it in the List, which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed. | |||||
| CVE-2021-24621 | 1 Stratospheredigital | 1 Wp Courses Lms | 2024-11-21 | 3.5 LOW | 4.8 MEDIUM |
| The WP Courses LMS WordPress plugin before 2.0.44 does not sanitise its Video Embed Code, allowing malicious code to be injected in it by high privilege users, even when the unfiltered_html capability is disallowed, which could lead to Stored Cross-Site Scripting issues | |||||
| CVE-2021-24619 | 1 Evona | 1 Per Page Add To Head | 2024-11-21 | 3.5 LOW | 4.8 MEDIUM |
| The Per page add to head WordPress plugin through 1.4.4 does not properly sanitise one of its setting, allowing malicious HTML to be inserted by high privilege users even when the unfiltered_html capability is disallowed, which could lead to Cross-Site Scripting issues. | |||||
| CVE-2021-24618 | 1 Wbolt | 1 Donate With Qrcode | 2024-11-21 | 3.5 LOW | 5.4 MEDIUM |
| The Donate With QRCode WordPress plugin before 1.4.5 does not sanitise or escape its QRCode Image setting, which result into a Stored Cross-Site Scripting (XSS). Furthermore, the plugin also does not have any CSRF and capability checks in place when saving such setting, allowing any authenticated user (as low as subscriber), or unauthenticated user via a CSRF vector to update them and perform such attack. | |||||
| CVE-2021-24617 | 1 Gamepress Project | 1 Gamepress | 2024-11-21 | 4.3 MEDIUM | 6.1 MEDIUM |
| The GamePress WordPress plugin through 1.1.0 does not escape the op_edit POST parameter before outputting it back in multiple Game Option pages, leading to Reflected Cross-Site Scripting issues | |||||
| CVE-2021-24616 | 1 Addtoany | 1 Addtoany Share Buttons | 2024-11-21 | 3.5 LOW | 4.8 MEDIUM |
| The AddToAny Share Buttons WordPress plugin before 1.7.48 does not escape its Image URL button setting, which could lead allow high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed. | |||||
| CVE-2021-24615 | 1 Wechat Reward Project | 1 Wechat Reward | 2024-11-21 | 4.3 MEDIUM | 5.4 MEDIUM |
| The Wechat Reward WordPress plugin through 1.7 does not sanitise or escape its QR settings, nor has any CSRF check in place, allowing attackers to make a logged in admin change the settings and perform Cross-Site Scripting attacks. | |||||
| CVE-2021-24614 | 1 Oz-plugin | 1 Book Appointment Online | 2024-11-21 | 3.5 LOW | 4.8 MEDIUM |
| The Book appointment online WordPress plugin before 1.39 does not sanitise or escape Service Prices before outputting it in the List, which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed. | |||||