Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2021-36806 State: PUBLISHED Published: 2023-11-30T09:41:31.380Z Last Updated: 2024-12-02T18:09:46.060Z Severity: MEDIUM (CVSS 4.7 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:N) Vendors: Sophos Products: Sophos Email Appliance Problem Types: CWE-79 Description: A reflected XSS vulnerability allows an open redirect when the victim clicks a malicious link to an error page on Sophos Email Appliance older than version 4.5.3.4. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://community.sophos.com/email-appliance/b/blog/posts/sophos-email-appliance-version-4-5-3-4-released
CVE ID: CVE-2021-36807 State: PUBLISHED Published: 2021-11-26T14:12:47 Last Updated: 2024-08-04T01:01:59.660Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: Sophos Products: SG UTM Problem Types: n/a Description: An authenticated user could potentially execute code via an SQLi vulnerability in the user portal of SG UTM before version 9.708 MR8. Additional Analyst Notes: - CVE Program Container: References: - https://www.sophos.com/en-us/security-advisories/sophos-sa-20211126-sg-sqli
CVE ID: CVE-2021-36808 State: PUBLISHED Published: 2021-10-30T12:22:27 Last Updated: 2024-08-04T01:01:59.233Z Severity: MEDIUM (CVSS 5.9 CVSS:3.1/AV:P/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N) Vendors: Sophos Products: Sophos Secure Workspace for Android Problem Types: n/a Description: A local attacker could bypass the app password using a race condition in Sophos Secure Workspace for Android before version 9.7.3115. Additional Analyst Notes: - CVE Program Container: References: - https://www.sophos.com/en-us/security-advisories/sophos-sa-20211029-ssw-pw-bypass
CVE ID: CVE-2021-36809 State: PUBLISHED Published: 2022-03-07T23:45:11 Last Updated: 2024-08-04T01:01:59.782Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H) Vendors: Sophos Products: SSL VPN client Problem Types: n/a Description: A local attacker can overwrite arbitrary files on the system with VPN client logs using administrator privileges, potentially resulting in a denial of service and data loss, in all versions of Sophos SSL VPN client. Additional Analyst Notes: - CVE Program Container: References: - https://www.sophos.com/en-us/security-advisories/sophos-sa-20220303-sslvpn-local-dos
CVE ID: CVE-2021-36810 State: REJECTED Published: 2022-02-28T22:22:10 Last Updated: 2022-02-28T22:22:10 Description: No description available.
CVE ID: CVE-2021-36811 State: REJECTED Published: 2022-02-28T22:22:11 Last Updated: 2022-02-28T22:22:11 Description: No description available.
CVE ID: CVE-2021-36812 State: REJECTED Published: 2022-02-28T22:22:12 Last Updated: 2022-02-28T22:22:12 Description: No description available.
CVE ID: CVE-2021-36813 State: REJECTED Published: 2022-02-28T22:22:13 Last Updated: 2022-02-28T22:22:13 Description: No description available.
CVE ID: CVE-2021-36814 State: REJECTED Published: 2022-02-28T22:22:14 Last Updated: 2022-02-28T22:22:13 Description: No description available.
CVE ID: CVE-2021-36815 State: REJECTED Published: 2022-02-28T22:22:14 Last Updated: 2022-02-28T22:22:14 Description: No description available.
CVE ID: CVE-2021-36816 State: REJECTED Published: 2022-02-28T22:22:15 Last Updated: 2022-02-28T22:22:15 Description: No description available.
CVE ID: CVE-2021-36817 State: REJECTED Published: 2022-02-28T22:22:16 Last Updated: 2022-02-28T22:22:16 Description: No description available.
CVE ID: CVE-2021-36818 State: REJECTED Published: 2022-02-28T22:22:16 Last Updated: 2022-02-28T22:22:16 Description: No description available.
CVE ID: CVE-2021-36819 State: REJECTED Published: 2022-02-28T22:22:17 Last Updated: 2022-02-28T22:22:17 Description: No description available.
CVE ID: CVE-2021-36820 State: REJECTED Published: 2022-02-28T22:22:18 Last Updated: 2022-02-28T22:22:18 Description: No description available.
CVE ID: CVE-2021-36821 State: PUBLISHED Published: 2023-03-16T14:45:38.066Z Last Updated: 2024-08-18T21:46:15.781Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L) Vendors: WPMU DEV Products: Forminator Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in WPMU DEV Forminator allows Stored XSS.This issue affects Forminator: from n/a through 1.14.11. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://patchstack.com/database/vulnerability/forminator/wordpress-forminator-plugin-1-14-11-stored-cross-site-scripting-xss-vulnerability?_s_id=c
abase/vulnerability/forminator/wordpress-forminator-plugin-1-14-11-stored-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2021-36823 State: PUBLISHED Published: 2021-09-23T15:11:03.755850Z Last Updated: 2024-09-16T18:03:19.318Z Severity: MEDIUM (CVSS 6.6 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:L) Vendors: Cusmin Products: AGCA - Absolutely Glamorous Custom Admin (WordPress plugin) Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Cusmin AGCA - Absolutely Glamorous Custom Admin (WordPress plugin) allows Stored XSS.This issue affects AGCA - Absolutely Glamorous Custom Admin (WordPress plugin): from n/a through 6.8. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://p
rom n/a through 6.8. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://patchstack.com/database/vulnerability/ag-custom-admin/wordpress-absolutely-glamorous-custom-admin-plugin-6-8-authenticated-stored-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2021-36826 State: PUBLISHED Published: 2022-04-04T19:46:19.896Z Last Updated: 2025-04-23T18:41:37.909Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N) Vendors: weDevs Products: WP Project Manager (WordPress plugin) Problem Types: CWE-79 Description: Authenticated (subscriber or higher user role if allowed to access projects) Stored Cross-Site Scripting (XSS) vulnerability in weDevs WP Project Manager plugin <= 2.4.13 versions. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/wedevs-project-manager/wordpress-wp-project-manager-plugin-2-4-13-stored-cross-site-scripting-xs
/database/vulnerability/wedevs-project-manager/wordpress-wp-project-manager-plugin-2-4-13-stored-cross-site-scripting-xss-vulnerability-1?_s_id=cve
CVE ID: CVE-2021-36827 State: PUBLISHED Published: 2022-06-16T17:11:16.535313Z Last Updated: 2024-09-16T19:36:46.206Z Severity: MEDIUM (CVSS 4.8 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N) Vendors: Saturday Drive Products: Ninja Forms Contact Form (WordPress plugin) Problem Types: CWE-79 Description: Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Saturday Drive's Ninja Forms Contact Form plugin <= 3.6.9 at WordPress via "label". Additional Analyst Notes: - CVE Program Container: References: - https://patchstack.com/database/vulnerability/ninja-forms/wordpress-ninja-forms-contact-form-plugin-3-6-9-authenticated-stored-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2021-36828 State: PUBLISHED Published: 2022-04-15T16:24:47.084Z Last Updated: 2025-04-23T18:39:03.231Z Severity: MEDIUM (CVSS 4.8 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N) Vendors: Florent Maillefaud Products: WP Maintenance Problem Types: CWE-79 Description: Authenticated (admin+) Stored Cross-Site Scripting (XSS) in WP Maintenance plugin <= 6.0.7 versions. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/wp-maintenance/wordpress-wp-maintenance-plugin-6-0-4-authenticated-stored-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2021-36829 State: PUBLISHED Published: 2022-09-06T17:18:51.491Z Last Updated: 2025-02-20T20:09:35.504Z Severity: MEDIUM (CVSS 4.8 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N) Vendors: MyThemeShop Products: Launcher: Coming Soon & Maintenance Mode (WordPress plugin) Problem Types: CWE-79 Description: Authenticated (admin+) Stored Cross-Site Scripting (XSS) vulnerability in MyThemeShop Launcher: Coming Soon & Maintenance Mode plugin <= 1.0.11 at WordPress. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/launcher/wordpress-launcher-coming-soon-maintenance-mode-plugin-1-0-11-authenticated-stored-
.com/database/vulnerability/launcher/wordpress-launcher-coming-soon-maintenance-mode-plugin-1-0-11-authenticated-stored-cross-site-scripting-xss-vulnerability - https://wordpress.org/plugins/launcher/
CVE ID: CVE-2021-36830 State: PUBLISHED Published: 2022-09-30T16:14:58.930Z Last Updated: 2025-02-20T20:00:16.136Z Severity: MEDIUM (CVSS 4.8 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N) Vendors: mibuthu Products: Comment Guestbook (WordPress plugin) Problem Types: CWE-79 Description: Authenticated (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Comment Guestbook plugin <= 0.8.0 at WordPress. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/comment-guestbook/wordpress-comment-guestbook-plugin-0-8-0-authenticated-stored-cross-site-scripting-xss-vulnerability?_s_id=cve - https://wordpress.org/pl
-guestbook-plugin-0-8-0-authenticated-stored-cross-site-scripting-xss-vulnerability?_s_id=cve - https://wordpress.org/plugins/comment-guestbook/
CVE ID: CVE-2021-36832 State: PUBLISHED Published: 2021-10-19T14:13:21.105662Z Last Updated: 2024-10-01T15:52:44.838Z Severity: MEDIUM (CVSS 4.8 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N) Vendors: Icegram Products: Popups, Welcome Bar, Optins and Lead Generation Plugin – Icegram Problem Types: CWE-79 Description: WordPress Popups, Welcome Bar, Optins and Lead Generation Plugin – Icegram (versions <= 2.0.2) vulnerable at "Headline" (&message_data[16][headline]) input. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wordpress.org/plugins/icegram/#developers - https://patchstack.com/database/vulnerability/icegram/wordpress-icegram-plugin-2-0-
ss.org/plugins/icegram/#developers - https://patchstack.com/database/vulnerability/icegram/wordpress-icegram-plugin-2-0-2-authenticated-stored-cross-site-scripting-xss-vulnerability
CVE ID: CVE-2021-36833 State: PUBLISHED Published: 2022-05-20T19:55:54.898Z Last Updated: 2025-02-20T20:22:03.315Z Severity: MEDIUM (CVSS 4.8 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N) Vendors: ibericode Products: MC4WP: Mailchimp for WordPress Problem Types: CWE-79 Description: Authenticated (admin or higher user role) Stored Cross-Site Scripting (XSS) vulnerability in ibericode's MC4WP plugin <= 4.8.6 at WordPress. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wordpress.org/plugins/mailchimp-for-wp/#developers - https://patchstack.com/database/vulnerability/mailchimp-for-wp/wordpress-mc4wp-plugin-4-8-6-authenticated-stored-cross-site-s
://patchstack.com/database/vulnerability/mailchimp-for-wp/wordpress-mc4wp-plugin-4-8-6-authenticated-stored-cross-site-scripting-xss-vulnerability
CVE ID: CVE-2021-36839 State: PUBLISHED Published: 2022-09-30T16:14:55.217Z Last Updated: 2025-02-20T20:00:23.667Z Severity: MEDIUM (CVSS 4.8 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N) Vendors: Space X-Chimp Products: Social Media Follow Buttons Bar (WordPress plugin) Problem Types: CWE-79 Description: Authenticated (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Social Media Follow Buttons Bar plugin <= 4.73 at WordPress. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/social-media-buttons-toolbar/wordpress-social-media-follow-buttons-bar-plugin-4-73-authenticated-stored-cross-site-scripti
cial-media-buttons-toolbar/wordpress-social-media-follow-buttons-bar-plugin-4-73-authenticated-stored-cross-site-scripting-xss-vulnerability?_s_id=cve - https://wordpress.org/plugins/social-media-buttons-toolbar/
CVE ID: CVE-2021-36841 State: PUBLISHED Published: 2021-09-27T15:35:11.053Z Last Updated: 2025-03-28T16:49:47.361Z Severity: MEDIUM (CVSS 6.9 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:L/A:N) Vendors: YITH Products: YITH Maintenance Mode (WordPress plugin) Problem Types: CWE-79 Description: Authenticated Stored Cross-Site Scripting (XSS) vulnerability in YITH Maintenance Mode (WordPress plugin) versions <= 1.3.7, vulnerable parameter &yith_maintenance_newsletter_submit_label. Possible even when unfiltered HTML is disallowed by WordPress configuration. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wordpress.org/plugins/yith-maintenance-mode/#dev
- CVE Program Container: - CISA ADP Vulnrichment: References: - https://wordpress.org/plugins/yith-maintenance-mode/#developers - https://patchstack.com/database/vulnerability/yith-maintenance-mode/wordpress-yith-maintenance-mode-plugin-1-3-7-authenticated-stored-cross-site-scripting-xss-vulnerability
CVE ID: CVE-2021-36843 State: PUBLISHED Published: 2021-11-26T16:35:15.471Z Last Updated: 2025-03-28T16:45:38.640Z Severity: MEDIUM (CVSS 4.8 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N) Vendors: Acurax Technologies Products: Floating Social Media Icon (WordPress plugin) Problem Types: CWE-79 Description: Authenticated Stored Cross-Site Scripting (XSS) vulnerability discovered in WordPress Floating Social Media Icon plugin (versions <= 4.3.5) Social Media Configuration form. Requires high role user like admin. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wordpress.org/plugins/floating-social-media-icon/ - https://patchstack.com/database/v
ulnrichment: References: - https://wordpress.org/plugins/floating-social-media-icon/ - https://patchstack.com/database/vulnerability/floating-social-media-icon/wordpress-floating-social-media-icon-plugin-4-3-5-authenticated-stored-cross-site-scripting-xss-vulnerability
CVE ID: CVE-2021-36844 State: PUBLISHED Published: 2022-05-02T19:08:20.871Z Last Updated: 2025-02-20T20:23:40.288Z Severity: LOW (CVSS 3.4 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:N/I:L/A:N) Vendors: MyThemeShop Products: WP Subscribe (WordPress plugin) Problem Types: CWE-79 Description: Authenticated (admin+) Stored Cross-Site Scripting (XSS) vulnerability in MyThemeShop WP Subscribe plugin <= 1.2.12 on WordPress. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wordpress.org/plugins/wp-subscribe/#developers - https://patchstack.com/database/vulnerability/wp-subscribe/wordpress-wp-subscribe-plugin-1-2-12-authenticated-stored-cross-site-scripting-xs
om/database/vulnerability/wp-subscribe/wordpress-wp-subscribe-plugin-1-2-12-authenticated-stored-cross-site-scripting-xss-vulnerability
CVE ID: CVE-2021-36845 State: PUBLISHED Published: 2021-09-27T15:36:56.716Z Last Updated: 2025-03-28T16:49:27.129Z Severity: MEDIUM (CVSS 6.9 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:L/A:N) Vendors: YITH Products: YITH Maintenance Mode (WordPress plugin) Problem Types: CWE-79 Description: Multiple Authenticated Stored Cross-Site Scripting (XSS) vulnerabilities in YITH Maintenance Mode (WordPress plugin) versions <= 1.3.8, there are 46 vulnerable parameters that were missed by the vendor while patching the 1.3.7 version to 1.3.8. Vulnerable parameters: 1 - "Newsletter" tab, &yith_maintenance_newsletter_submit_label parameter: payload should start with a single quote (') symbol to break the cont
ith_maintenance_newsletter_submit_label parameter: payload should start with a single quote (') symbol to break the context, i.e.: NOTIFY ME' autofocus onfocus=alert(/Visse/);// v=' - this payload will be auto triggered while admin visits this page/tab. 2 - "General" tab issues, vulnerable parameters: &yith_maintenance_message, &yith_maintenance_custom_style, &yith_maintenance_mascotte, &yith_maintenance_title_font[size], &yith_maintenance_title_font[family], &yith_maintenance_title_font[color], &yith_maintenance_paragraph_font[size], &yith_maintenance_paragraph_font[family], &yith_maintenance_paragraph_font[color], &yith_maintenance_border_top. 3 - "Background" tab issues, vulnerable parame
], &yith_maintenance_paragraph_font[color], &yith_maintenance_border_top. 3 - "Background" tab issues, vulnerable parameters: &yith_maintenance_background_image, &yith_maintenance_background_color. 4 - "Logo" tab issues, vulnerable parameters: &yith_maintenance_logo_image, &yith_maintenance_logo_tagline, &yith_maintenance_logo_tagline_font[size], &yith_maintenance_logo_tagline_font[family], &yith_maintenance_logo_tagline_font[color]. 5 - "Newsletter" tab issues, vulnerable parameters: &yith_maintenance_newsletter_email_font[size], &yith_maintenance_newsletter_email_font[family], &yith_maintenance_newsletter_email_font[color], &yith_maintenance_newsletter_submit_font[size], &yith_maintenance_
ily], &yith_maintenance_newsletter_email_font[color], &yith_maintenance_newsletter_submit_font[size], &yith_maintenance_newsletter_submit_font[family], &yith_maintenance_newsletter_submit_font[color], &yith_maintenance_newsletter_submit_background, &yith_maintenance_newsletter_submit_background_hover, &yith_maintenance_newsletter_title, &yith_maintenance_newsletter_action, &yith_maintenance_newsletter_email_label, &yith_maintenance_newsletter_email_name, &yith_maintenance_newsletter_submit_label, &yith_maintenance_newsletter_hidden_fields. 6 - "Socials" tab issues, vulnerable parameters: &yith_maintenance_socials_facebook, &yith_maintenance_socials_twitter, &yith_maintenance_socials_gplus, &
le parameters: &yith_maintenance_socials_facebook, &yith_maintenance_socials_twitter, &yith_maintenance_socials_gplus, &yith_maintenance_socials_youtube, &yith_maintenance_socials_rss, &yith_maintenance_socials_skype, &yith_maintenance_socials_email, &yith_maintenance_socials_behance, &yith_maintenance_socials_dribble, &yith_maintenance_socials_flickr, &yith_maintenance_socials_instagram, &yith_maintenance_socials_pinterest, &yith_maintenance_socials_tumblr, &yith_maintenance_socials_linkedin. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wordpress.org/plugins/yith-maintenance-mode/#developers - https://patchstack.com/database/vulnerability
ences: - https://wordpress.org/plugins/yith-maintenance-mode/#developers - https://patchstack.com/database/vulnerability/yith-maintenance-mode/wordpress-yith-maintenance-mode-plugin-1-3-8-multiple-authenticated-stored-cross-site-scripting-xss-vulnerabilities
CVE ID: CVE-2021-36846 State: PUBLISHED Published: 2022-04-11T19:37:41.707Z Last Updated: 2025-02-20T20:28:13.632Z Severity: MEDIUM (CVSS 4.8 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N) Vendors: Premio Products: Chaty (WordPress plugin) Problem Types: CWE-79 Description: Authenticated (admin or higher user role) Stored Cross-Site Scripting (XSS) vulnerability in Premio Chaty (WordPress plugin) <= 2.8.3 Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wordpress.org/plugins/chaty/ - https://patchstack.com/database/vulnerability/chaty/wordpress-chaty-plugin-2-8-3-authenticated-stored-cross-site-scripting-xss-vulnerability
CVE ID: CVE-2021-36847 State: PUBLISHED Published: 2022-08-22T14:44:48.423Z Last Updated: 2025-02-20T20:13:34.187Z Severity: MEDIUM (CVSS 4.8 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N) Vendors: WebbaPlugins Products: Webba Booking (WordPress plugin) Problem Types: CWE-79 Description: Authenticated (admin+) Stored Cross-Site Scripting (XSS) vulnerability in WebbaPlugins Webba Booking plugin <= 4.2.21 at WordPress. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/webba-booking-lite/wordpress-webba-booking-plugin-4-2-21-authenticated-stored-cross-site-scripting-xss-vulnerability - https://wordpress.org/plu
ress-webba-booking-plugin-4-2-21-authenticated-stored-cross-site-scripting-xss-vulnerability - https://wordpress.org/plugins/webba-booking-lite/#developers
CVE ID: CVE-2021-36848 State: PUBLISHED Published: 2022-04-11T19:36:56.299Z Last Updated: 2025-02-20T20:28:27.703Z Severity: LOW (CVSS 3.4 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:N/I:L/A:N) Vendors: Socialmediafeather Products: Social Media Feather (WordPress plugin) Problem Types: CWE-79 Description: Authenticated (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Social Media Feather (WordPress plugin) versions <= 2.0.4 Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wordpress.org/plugins/social-media-feather/#developers - https://patchstack.com/database/vulnerability/social-media-feather/wordpress-social-media-feather-plugin-2-0-4-auth
rs - https://patchstack.com/database/vulnerability/social-media-feather/wordpress-social-media-feather-plugin-2-0-4-authenticated-stored-cross-site-scripting-xss-vulnerability
CVE ID: CVE-2021-36849 State: PUBLISHED Published: 2022-07-20T18:35:29.806Z Last Updated: 2025-02-20T20:17:52.733Z Severity: LOW (CVSS 3.4 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:N/I:L/A:N) Vendors: René Hermenau Products: Social Media Share Buttons | MashShare (WordPress plugin) Problem Types: CWE-79 Description: Authenticated (admin+) Stored Cross-Site Scripting (XSS) vulnerability in René Hermenau's Social Media Share Buttons plugin <= 3.8.1 at WordPress. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/mashsharer/wordpress-social-media-share-buttons-plugin-3-8-1-authenticated-stored-cross-site-scripting-xss
vulnerability/mashsharer/wordpress-social-media-share-buttons-plugin-3-8-1-authenticated-stored-cross-site-scripting-xss-vulnerability - https://wordpress.org/plugins/mashsharer/#developers
CVE ID: CVE-2021-36850 State: PUBLISHED Published: 2021-10-04T16:57:04.025Z Last Updated: 2025-03-28T16:48:34.314Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L) Vendors: Meow Apps Products: Media File Renamer – Auto & Manual Rename (WordPress plugin) Problem Types: CWE-352 Description: Cross-Site Request Forgery (CSRF) vulnerability in WordPress Media File Renamer – Auto & Manual Rename plugin (versions <= 5.1.9). Affected parameters "post_title", "filename", "lock". This allows changing the uploaded media title, media file name, and media locking state. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wordpress.org/
state. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wordpress.org/plugins/media-file-renamer/#developers - https://patchstack.com/database/vulnerability/media-file-renamer/wordpress-media-file-renamer-plugin-5-1-9-multiple-cross-site-request-forgery-csrf-vulnerabilities
CVE ID: CVE-2021-36851 State: PUBLISHED Published: 2022-04-04T19:46:18.797Z Last Updated: 2025-02-20T20:28:44.030Z Severity: MEDIUM (CVSS 4.1 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:N/I:L/A:N) Vendors: Web-Settler Products: Testimonial Slider – Free Testimonials Slider Plugin (WordPress plugin) Problem Types: CWE-79 Description: Authenticated (editor or higher user role) Cross-Site Scripting (XSS) vulnerability in Web-Settler Testimonial Slider – Free Testimonials Slider Plugin (WordPress plugin) via parameters mpsp_posts_bg_color, mpsp_posts_description_color, mpsp_slide_nav_button_color. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wordpress.
tton_color. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wordpress.org/plugins/testimonial-add/#developers - https://patchstack.com/database/vulnerability/testimonial-add/wordpress-testimonial-slider-plugin-3-5-8-3-cross-site-scripting-xss-vulnerability