Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2021-39318 State: PUBLISHED Published: 2021-12-14T15:50:11.666Z Last Updated: 2025-02-13T20:47:02.487Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: H5P CSS Editor Products: H5P CSS Editor Problem Types: CWE-79 Description: The H5P CSS Editor WordPress plugin is vulnerable to Reflected Cross-Site Scripting via the h5p-css-file parameter found in the ~/h5p-css-editor.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 1.0. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/vulnerability-advisories/#CVE-2021-39318 - https://plugins.trac.w
Vulnrichment: References: - https://www.wordfence.com/vulnerability-advisories/#CVE-2021-39318 - https://plugins.trac.wordpress.org/browser/h5p-css-editor/tags/1.0/h5p-css-editor.php#L50
CVE ID: CVE-2021-39319 State: PUBLISHED Published: 2021-12-14T15:50:09.401Z Last Updated: 2025-02-13T20:47:45.352Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: duoFAQ - Responsive, Flat, Simple FAQ Products: duoFAQ - Responsive, Flat, Simple FAQ Problem Types: CWE-79 Description: The duoFAQ - Responsive, Flat, Simple FAQ WordPess plugin is vulnerable to Reflected Cross-Site Scripting via the msg parameter found in the ~/duogeek/duogeek-panel.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 1.4.8. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.c
1.4.8. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/vulnerability-advisories/#CVE-2021-39319 - https://plugins.trac.wordpress.org/browser/duofaq-responsive-flat-simple-faq/tags/1.4.8/duogeek/duogeek-panel.php#L388
CVE ID: CVE-2021-39320 State: PUBLISHED Published: 2021-09-01T14:15:35.899Z Last Updated: 2025-05-05T14:50:43.201Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: Noah Kagan Products: underConstruction Problem Types: CWE-79 Description: The underConstruction plugin <= 1.18 for WordPress echoes out the raw value of `$GLOBALS['PHP_SELF']` in the ucOptions.php file. On certain configurations including Apache+modPHP, this makes it possible to use it to perform a reflected Cross-Site Scripting attack by injecting malicious code in the request path. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnera
th. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/49ae1df0-d6d2-4cbb-9a9d-bf3599429875 - https://www.wordfence.com/vulnerability-advisories/#CVE-2021-39320
CVE ID: CVE-2021-39321 State: PUBLISHED Published: 2021-10-21T19:38:52.886Z Last Updated: 2025-03-31T17:58:03.771Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: Sassy Social Share Products: Sassy Social Share Problem Types: CWE-863, CWE-502 Description: Version 3.3.23 of the Sassy Social Share WordPress plugin is vulnerable to PHP Object Injection via the wp_ajax_heateor_sss_import_config AJAX action due to deserialization of unvalidated user supplied inputs via the import_config function found in the ~/admin/class-sassy-social-share-admin.php file. This can be exploited by underprivileged authenticated users due to a missing capability check on the import_c
php file. This can be exploited by underprivileged authenticated users due to a missing capability check on the import_config function. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/vulnerability-advisories/#CVE-2021-39321 - https://www.wordfence.com/blog/2021/10/vulnerability-patched-in-sassy-social-share-plugin/ - https://plugins.trac.wordpress.org/changeset/2600464/sassy-social-share/trunk/admin/class-sassy-social-share-admin.php
CVE ID: CVE-2021-39322 State: PUBLISHED Published: 2021-09-02T16:42:38.821Z Last Updated: 2025-05-05T14:50:25.709Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: cybernetikz Products: Easy Social Icons Problem Types: CWE-79 Description: The Easy Social Icons plugin <= 3.0.8 for WordPress echoes out the raw value of `$_SERVER['PHP_SELF']` in its main file. On certain configurations including Apache+modPHP this makes it possible to use it to perform a reflected Cross-Site Scripting attack by injecting malicious code in the request path. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpvulndb.com/vulnerabiliti
tional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpvulndb.com/vulnerabilities/5e0bf0b6-9809-426b-b1d4-1fb653083b58 - https://www.wordfence.com/vulnerability-advisories/#CVE-2021-39322
CVE ID: CVE-2021-39324 State: REJECTED Published: 2022-09-06T17:19:03 Last Updated: 2022-09-06T17:19:03 Description: No description available.
CVE ID: CVE-2021-39325 State: PUBLISHED Published: 2021-09-20T19:59:22.642Z Last Updated: 2025-03-31T18:21:20.678Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: OptinMonster Products: OptinMonster Problem Types: CWE-79 Description: The OptinMonster WordPress plugin is vulnerable to Reflected Cross-Site Scripting due to insufficient input validation in the load_previews function found in the ~/OMAPI/Output.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 2.6.0. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/vulnerability-advisories/#CVE-2021-
Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/vulnerability-advisories/#CVE-2021-39325 - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=2595758%40optinmonster&new=2595758%40optinmonster&sfp_email=&sfph_mail=#file2
CVE ID: CVE-2021-39326 State: REJECTED Published: 2022-09-06T17:19:03 Last Updated: 2022-09-06T17:19:03 Description: No description available.
CVE ID: CVE-2021-39327 State: PUBLISHED Published: 2021-09-17T10:26:21.264Z Last Updated: 2025-03-31T18:21:46.022Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: AITpro Products: BulletProof Security Problem Types: CWE-200 Description: The BulletProof Security WordPress plugin is vulnerable to sensitive information disclosure due to a file path disclosure in the publicly accessible ~/db_backup_log.txt file which grants attackers the full path of the site, in addition to the path of database backup files. This affects versions up to, and including, 5.1. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.word
cluding, 5.1. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/vulnerability-advisories/#CVE-2021-39327 - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=2591118%40bulletproof-security&new=2591118%40bulletproof-security&sfp_email=&sfph_mail= - http://packetstormsecurity.com/files/164420/WordPress-BulletProof-Security-5.1-Information-Disclosure.html - https://github.com/Hacker5preme/Exploits/tree/main/Wordpress/CVE-2021-39327 - https://www.exploit-db.com/exploits/50382
CVE ID: CVE-2021-39328 State: PUBLISHED Published: 2021-10-21T19:38:47.154Z Last Updated: 2025-02-14T17:54:07.335Z Severity: MEDIUM (CVSS 5.5 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N) Vendors: Simple Job Board Products: Simple Job Board Problem Types: CWE-79 Description: The Simple Job Board WordPress plugin is vulnerable to Stored Cross-Site Scripting due to insufficient escaping on the $job_board_privacy_policy_label variable echo'd out via the ~/admin/settings/class-simple-job-board-settings-privacy.php file which allowed attackers with administrative user access to inject arbitrary web scripts, in versions up to and including 2.9.4. This affects multi-site installations where unfilte
inject arbitrary web scripts, in versions up to and including 2.9.4. This affects multi-site installations where unfiltered_html is disabled for administrators, and sites where unfiltered_html is disabled. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/vulnerability-advisories/#CVE-2021-39328 - https://github.com/BigTiger2020/word-press/blob/main/Simple%20Job%20Board%E2%80%94Stored%20Cross-Site%20Scripting%20-%202.md - https://plugins.trac.wordpress.org/changeset/2617364/simple-job-board/trunk/admin/settings/class-simple-job-board-settings-privacy.php
CVE ID: CVE-2021-39329 State: PUBLISHED Published: 2021-10-19T14:14:51.612Z Last Updated: 2025-02-14T17:53:28.080Z Severity: MEDIUM (CVSS 5.5 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N) Vendors: JobBoardWP Products: JobBoardWP Problem Types: CWE-79 Description: The JobBoardWP WordPress plugin is vulnerable to Stored Cross-Site Scripting due to insufficient input validation and sanitization via several parameters found in the ~/includes/admin/class-metabox.php file which allowed attackers with administrative user access to inject arbitrary web scripts, in versions up to and including 1.0.7. This affects multi-site installations where unfiltered_html is disabled for administrators, and sites
d including 1.0.7. This affects multi-site installations where unfiltered_html is disabled for administrators, and sites where unfiltered_html is disabled. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/vulnerability-advisories/#CVE-2021-39329 - https://github.com/BigTiger2020/word-press/blob/main/JobBoardWP%20%E2%80%93%20Job%20Board%20Listings%20and%20Submissions.md - https://plugins.trac.wordpress.org/browser/jobboardwp/trunk/includes/admin/class-metabox.php#L165
CVE ID: CVE-2021-39330 State: REJECTED Published: 2021-10-14T15:57:02 Last Updated: 2021-11-04T13:53:38 Description: No description available.
CVE ID: CVE-2021-39332 State: PUBLISHED Published: 2021-10-15T12:15:15.115Z Last Updated: 2025-02-14T18:10:57.252Z Severity: MEDIUM (CVSS 5.5 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N) Vendors: Business Manager Products: Business Manager Problem Types: CWE-79 Description: The Business Manager WordPress plugin is vulnerable to Stored Cross-Site Scripting due to insufficient input validation and sanitization found throughout the plugin which allowed attackers with administrative user access to inject arbitrary web scripts, in versions up to and including 1.4.5. This affects multi-site installations where unfiltered_html is disabled for administrators, and sites where unfiltered_html is disa
s multi-site installations where unfiltered_html is disabled for administrators, and sites where unfiltered_html is disabled. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/vulnerability-advisories/#CVE-2021-39332
CVE ID: CVE-2021-39333 State: PUBLISHED Published: 2021-11-01T21:01:12.000Z Last Updated: 2025-03-31T17:46:23.086Z Severity: HIGH (CVSS 8.1 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H) Vendors: Hashthemes Products: Hashthemes Demo Importer Problem Types: CWE-284 Description: The Hashthemes Demo Importer Plugin <= 1.1.1 for WordPress contained several AJAX functions which relied on a nonce which was visible to all logged-in users for access control, allowing them to execute a function that truncated nearly all database tables and removed the contents of wp-content/uploads. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/blog
Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/blog/2021/10/site-deletion-vulnerability-in-hashthemes-plugin/
CVE ID: CVE-2021-39334 State: PUBLISHED Published: 2021-10-15T12:15:20.198Z Last Updated: 2025-02-14T17:57:18.922Z Severity: MEDIUM (CVSS 5.5 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N) Vendors: Job Board Vanila Plugin Products: Job Board Vanila Plugin Problem Types: CWE-79 Description: The Job Board Vanila WordPress plugin is vulnerable to Stored Cross-Site Scripting due to insufficient input validation and sanitization via the psjb_exp_in and the psjb_curr_in parameters found in the ~/job-settings.php file which allowed attackers with administrative user access to inject arbitrary web scripts, in versions up to and including 1.0. This affects multi-site installations where unfiltered_htm
t arbitrary web scripts, in versions up to and including 1.0. This affects multi-site installations where unfiltered_html is disabled for administrators, and sites where unfiltered_html is disabled. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/vulnerability-advisories/#CVE-2021-39334 - https://github.com/BigTiger2020/word-press/blob/main/Job%20Board%20Vanila%20Plugin-2.md - https://plugins.trac.wordpress.org/browser/job-board-vanilla/trunk/job-settings.php
CVE ID: CVE-2021-39335 State: PUBLISHED Published: 2021-10-15T12:15:47.606Z Last Updated: 2025-03-31T17:59:32.024Z Severity: MEDIUM (CVSS 5.5 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N) Vendors: WpGenius Job Listing Products: WpGenius Job Listing Problem Types: CWE-79 Description: The WpGenius Job Listing WordPress plugin is vulnerable to Stored Cross-Site Scripting due to insufficient input validation and sanitization via several parameters found in the ~/src/admin/class/class-wpgenious-job-listing-options.php file which allowed attackers with administrative user access to inject arbitrary web scripts, in versions up to and including 1.0.2. This affects multi-site installations where unfi
to inject arbitrary web scripts, in versions up to and including 1.0.2. This affects multi-site installations where unfiltered_html is disabled for administrators, and sites where unfiltered_html is disabled. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/vulnerability-advisories/#CVE-2021-39335 - https://github.com/BigTiger2020/word-press/blob/main/WpGenius%20Job%20Listing.md - https://plugins.trac.wordpress.org/browser/wpgenious-job-listing/trunk/src/admin/class/class-wpgenious-job-listing-options.php
CVE ID: CVE-2021-39336 State: PUBLISHED Published: 2021-10-15T12:15:25.277Z Last Updated: 2025-02-14T17:57:00.907Z Severity: MEDIUM (CVSS 5.5 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N) Vendors: Job Manager Products: Job Manager Problem Types: CWE-79 Description: The Job Manager WordPress plugin is vulnerable to Stored Cross-Site Scripting due to insufficient input validation and sanitization via several parameters found in the ~/admin-jobs.php file which allowed attackers with administrative user access to inject arbitrary web scripts, in versions up to and including 0.7.25. This affects multi-site installations where unfiltered_html is disabled for administrators, and sites where unfilte
.25. This affects multi-site installations where unfiltered_html is disabled for administrators, and sites where unfiltered_html is disabled. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/vulnerability-advisories/#CVE-2021-39336 - https://github.com/BigTiger2020/word-press/blob/main/Job%20Manager.md - https://plugins.trac.wordpress.org/browser/job-manager/trunk/admin-jobs.php#L244
CVE ID: CVE-2021-39337 State: PUBLISHED Published: 2021-10-15T12:15:30.440Z Last Updated: 2025-03-31T18:10:16.421Z Severity: MEDIUM (CVSS 5.5 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N) Vendors: job-portal Products: job-portal Problem Types: CWE-79 Description: The job-portal WordPress plugin is vulnerable to Stored Cross-Site Scripting due to insufficient input validation and sanitization via several parameters found in the ~/admin/jobs_function.php file which allowed attackers with administrative user access to inject arbitrary web scripts, in versions up to and including 0.0.1. This affects multi-site installations where unfiltered_html is disabled for administrators, and sites where un
ng 0.0.1. This affects multi-site installations where unfiltered_html is disabled for administrators, and sites where unfiltered_html is disabled. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/vulnerability-advisories/#CVE-2021-39337 - https://github.com/BigTiger2020/word-press/blob/main/job-portal.md - https://plugins.trac.wordpress.org/browser/job-portal/trunk/admin/jobs_function.php#L99
CVE ID: CVE-2021-39338 State: PUBLISHED Published: 2021-10-15T12:15:41.796Z Last Updated: 2025-03-31T17:59:47.215Z Severity: MEDIUM (CVSS 5.5 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N) Vendors: MyBB Cross-Poster Products: MyBB Cross-Poster Problem Types: CWE-79 Description: The MyBB Cross-Poster WordPress plugin is vulnerable to Stored Cross-Site Scripting due to insufficient input validation and sanitization via several parameters found in the ~/classes/MyBBXPSettings.php file which allowed attackers with administrative user access to inject arbitrary web scripts, in versions up to and including 1.0. This affects multi-site installations where unfiltered_html is disabled for administrato
rsions up to and including 1.0. This affects multi-site installations where unfiltered_html is disabled for administrators, and sites where unfiltered_html is disabled. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/vulnerability-advisories/#CVE-2021-39338 - https://github.com/BigTiger2020/word-press/blob/main/MyBB%20Cross-Poster.md - https://plugins.trac.wordpress.org/browser/mybb-cross-poster/trunk/classes/MyBBXPSettings.php
CVE ID: CVE-2021-39339 State: PUBLISHED Published: 2021-09-22T10:38:17.540Z Last Updated: 2025-03-31T18:20:31.937Z Severity: MEDIUM (CVSS 5.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:L) Vendors: Telefication Products: Telefication Problem Types: CWE-918 Description: The Telefication WordPress plugin is vulnerable to Open Proxy and Server-Side Request Forgery via the ~/bypass.php file due to a user-supplied URL request value that gets called by a curl requests. This affects versions up to, and including, 1.8.0. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/vulnerability-advisories/#CVE-2021-39339 - https://plugins.trac.wo
Vulnrichment: References: - https://www.wordfence.com/vulnerability-advisories/#CVE-2021-39339 - https://plugins.trac.wordpress.org/browser/telefication/tags/1.8.0/bypass.php
CVE ID: CVE-2021-39340 State: PUBLISHED Published: 2021-11-01T21:01:17.933Z Last Updated: 2025-03-31T17:45:55.631Z Severity: MEDIUM (CVSS 4.8 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N) Vendors: Notification – Custom Notifications and Alerts for WordPress Products: Notification – Custom Notifications and Alerts for WordPress Problem Types: CWE-79 Description: The Notification WordPress plugin is vulnerable to Stored Cross-Site Scripting due to insufficient input validation and sanitization via several parameters found in the ~/src/classes/Utils/Settings.php file which made it possible for attackers with administrative user access to inject arbitrary web scripts, in versions up to and inclu
e it possible for attackers with administrative user access to inject arbitrary web scripts, in versions up to and including 7.2.4. This affects multi-site installations where unfiltered_html is disabled for administrators, and sites where unfiltered_html is disabled. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/BigTiger2020/word-press/blob/main/Notification.md - https://wordfence.com/vulnerability-advisories/#CVE-2021-39340 - https://plugins.trac.wordpress.org/browser/notification/tags/7.2.4/src/classes/Utils/Settings.php#L167
CVE ID: CVE-2021-39341 State: PUBLISHED Published: 2021-11-01T21:01:23.439Z Last Updated: 2025-03-31T17:45:22.682Z Severity: HIGH (CVSS 8.2 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N) Vendors: OptinMonster Products: OptinMonster Problem Types: CWE-285, CWE-319 Description: The OptinMonster WordPress plugin is vulnerable to sensitive information disclosure and unauthorized setting updates due to insufficient authorization validation via the logged_in_or_has_api_key function in the ~/OMAPI/RestApi.php file that can used to exploit inject malicious web scripts on sites with the plugin installed. This affects versions up to, and including, 2.6.4. Additional Analyst Notes: - CVE Program Contain
the plugin installed. This affects versions up to, and including, 2.6.4. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/blog/2021/10/1000000-sites-affected-by-optinmonster-vulnerabilities/ - https://wordfence.com/vulnerability-advisories/#CVE-2021-39341 - https://plugins.trac.wordpress.org/browser/optinmonster/trunk/OMAPI/RestApi.php?rev=2606519#L1460
CVE ID: CVE-2021-39342 State: PUBLISHED Published: 2021-09-29T19:39:49.124Z Last Updated: 2025-03-31T18:11:47.779Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: Credova Financial Products: Credova_Financial Problem Types: CWE-319 Description: The Credova_Financial WordPress plugin discloses a site's associated Credova API account username and password in plaintext via an AJAX action whenever a site user goes to checkout on a page that has the Credova Financing option enabled. This affects versions up to, and including, 1.4.8. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/vulnerability-ad
nalyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/vulnerability-advisories/#CVE-2021-39342 - https://plugins.trac.wordpress.org/changeset/2606811/credova-financial/trunk/credova-financial.php
CVE ID: CVE-2021-39343 State: PUBLISHED Published: 2021-10-19T14:14:56.445Z Last Updated: 2025-02-14T17:53:05.336Z Severity: MEDIUM (CVSS 5.5 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N) Vendors: MPL-Publisher Products: MPL-Publisher Problem Types: CWE-79 Description: The MPL-Publisher WordPress plugin is vulnerable to Stored Cross-Site Scripting due to insufficient input validation and sanitization via several parameters found in the ~/libs/PublisherController.php file which allowed attackers with administrative user access to inject arbitrary web scripts, in versions up to and including 1.30.2. This affects multi-site installations where unfiltered_html is disabled for administrators, and
to and including 1.30.2. This affects multi-site installations where unfiltered_html is disabled for administrators, and sites where unfiltered_html is disabled. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/vulnerability-advisories/#CVE-2021-39343 - https://plugins.trac.wordpress.org/browser/mpl-publisher/trunk/libs/PublisherController.php#L35 - https://github.com/BigTiger2020/word-press/blob/main/MPL-Publisher.md
CVE ID: CVE-2021-39344 State: PUBLISHED Published: 2021-10-15T12:15:52.829Z Last Updated: 2025-02-14T17:56:29.997Z Severity: MEDIUM (CVSS 5.5 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N) Vendors: KJM Admin Notices Products: KJM Admin Notices Problem Types: CWE-79 Description: The KJM Admin Notices WordPress plugin is vulnerable to Stored Cross-Site Scripting due to insufficient input validation and sanitization via several parameters found in the ~/admin/class-kjm-admin-notices-admin.php file which allowed attackers with administrative user access to inject arbitrary web scripts, in versions up to and including 2.0.1. This affects multi-site installations where unfiltered_html is disabled f