Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2021-24427 State: PUBLISHED Published: 2021-07-12T19:20:58 Last Updated: 2024-08-03T19:28:23.956Z Vendors: BoldGrid Products: W3 Total Cache Problem Types: CWE-79 Description: The W3 Total Cache WordPress plugin before 2.1.3 did not sanitise or escape some of its CDN settings, allowing high privilege users to use JavaScript in them, which will be output in the page, leading to an authenticated Stored Cross-Site Scripting issue Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/5da5ce9a-82a6-404f-8dec-795d7905b3f9 - https://m0ze.ru/vulnerability/%5B2021-04-25%5D-%5BWordPress%5D-%5BCWE-79%5D-W3-Total-Cache-WordPress-Plugin-v2.1.2.txt
CVE ID: CVE-2021-24428 State: PUBLISHED Published: 2021-08-02T10:31:55 Last Updated: 2024-08-03T19:28:23.805Z Vendors: Unknown Products: RSS for Yandex Turbo Problem Types: CWE-79 Description: The RSS for Yandex Turbo WordPress plugin through 1.30 does not sanitise or escape some of its settings before saving and outputing them in the admin dashboard, leading to an Authenticated Stored Cross-Site Scripting issue even when the unfiltered_html capability is disallowed. Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/9fcf6ebe-01d9-4730-a20e-58b192bb6d87 - https://m0ze.ru/vulnerability/%5B2021-04-23%5D-%5BWordPress%5D-%5BCWE-79%5D-RSS-for-Yandex-
1d9-4730-a20e-58b192bb6d87 - https://m0ze.ru/vulnerability/%5B2021-04-23%5D-%5BWordPress%5D-%5BCWE-79%5D-RSS-for-Yandex-Turbo-WordPress-Plugin-v1.30.txt
CVE ID: CVE-2021-24429 State: PUBLISHED Published: 2021-07-12T19:20:59 Last Updated: 2024-08-03T19:28:23.972Z Vendors: Salon Booking System Products: Salon booking system Problem Types: CWE-79 Description: The Salon booking system WordPress plugin before 6.3.1 does not properly sanitise and escape the First Name field when booking an appointment, allowing low privilege users such as subscriber to set JavaScript in them, leading to a Stored Cross-Site Scripting (XSS) vulnerability. The Payload will then be triggered when an admin visits the "Calendar" page and the malicious script is executed in the admin context. Additional Analyst Notes: - CVE Program Container: References: - https://wpscan
script is executed in the admin context. Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/e922b788-7da5-43b4-9b05-839c8610252a
CVE ID: CVE-2021-24430 State: PUBLISHED Published: 2021-08-02T10:31:56 Last Updated: 2024-08-03T19:28:23.974Z Vendors: Unknown Products: Speed Booster Pack ⚡ PageSpeed Optimization Suite Problem Types: CWE-94 Description: The Speed Booster Pack ⚡ PageSpeed Optimization Suite WordPress plugin before 4.2.0 did not validate its caching_exclude_urls and caching_include_query_strings settings before outputting them in a PHP file, which could lead to RCE Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/945d6d2e-fa25-42c0-a7b4-b1794732a0df - https://m0ze.ru/vulnerability/%5B2021-05-10%5D-%5BWordPress%5D-%5BCWE-94%5D-Speed-Booster-Pack-WordPress-Plugi
732a0df - https://m0ze.ru/vulnerability/%5B2021-05-10%5D-%5BWordPress%5D-%5BCWE-94%5D-Speed-Booster-Pack-WordPress-Plugin-v4.2.0-beta.txt
CVE ID: CVE-2021-24431 State: PUBLISHED Published: 2021-09-13T17:56:14 Last Updated: 2024-08-03T19:28:23.955Z Vendors: Unknown Products: Language Bar Flags Problem Types: CWE-79, CWE-352 Description: The Language Bar Flags WordPress plugin through 1.0.8 does not have any CSRF in place when saving its settings and did not sanitise or escape them when generating the flag bar in the frontend. This could allow attackers to make a logged in admin change the settings, and set Cross-Site Scripting payload in them, which will be executed in the frontend for all users Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/ae50cec9-5f80-4221-b6a8-4593ab66c37b
CVE ID: CVE-2021-24432 State: PUBLISHED Published: 2024-01-16T15:49:30.490Z Last Updated: 2025-06-11T17:10:22.816Z Vendors: Unknown Products: Advanced AJAX Product Filters Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The Advanced AJAX Product Filters WordPress plugin does not sanitise the 'term_id' POST parameter before outputting it in the page, leading to reflected Cross-Site Scripting issue. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/b92ec5f7-d6a8-476f-a01e-21001a558914/
CVE ID: CVE-2021-24433 State: PUBLISHED Published: 2024-01-16T15:49:30.825Z Last Updated: 2025-06-02T15:10:57.085Z Vendors: Unknown Products: simple sort&search Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The simple sort&search WordPress plugin through 0.0.3 does not make sure that the indexurl parameter of the shortcodes "category_sims", "order_sims", "orderby_sims", "period_sims", and "tag_sims" use allowed URL protocols, which can lead to stored cross-site scripting by users with a role as low as Contributor Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/2ce8c786-ba82-427c-b5e7-e3b300a24c5f/
CVE ID: CVE-2021-24434 State: PUBLISHED Published: 2021-07-12T19:21:00 Last Updated: 2024-08-03T19:28:23.978Z Vendors: Unknown Products: Glass Problem Types: CWE-79, CWE-352 Description: The Glass WordPress plugin through 1.3.2 does not sanitise or escape its "Glass Pages" setting before outputting in a page, leading to a Stored Cross-Site Scripting issue. Furthermore, the plugin did not have CSRF check in place when saving its settings, allowing the issue to be exploited via a CSRF attack. Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/dbea2dc2-83f6-4e70-b044-a68a4c9b9c39
CVE ID: CVE-2021-24435 State: PUBLISHED Published: 2021-09-06T11:09:24 Last Updated: 2024-08-03T19:28:23.965Z Vendors: Unknown Products: Titan Framework Problem Types: CWE-79 Description: The iframe-font-preview.php file of the titan-framework does not properly escape the font-weight and font-family GET parameters before outputting them back in an href attribute, leading to Reflected Cross-Site Scripting issues Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/a88ffc42-6611-406e-8660-3af24c9cc5e8
CVE ID: CVE-2021-24436 State: PUBLISHED Published: 2021-07-19T10:53:15 Last Updated: 2024-08-03T19:28:24.018Z Vendors: BoldGrid Products: W3 Total Cache Problem Types: CWE-79 Description: The W3 Total Cache WordPress plugin before 2.1.4 was vulnerable to a reflected Cross-Site Scripting (XSS) security vulnerability within the "extension" parameter in the Extensions dashboard, which is output in an attribute without being escaped first. This could allow an attacker, who can convince an authenticated admin into clicking a link, to run malicious JavaScript within the user's web browser, which could lead to full site compromise. Additional Analyst Notes: - CVE Program Container: References: - ht
b browser, which could lead to full site compromise. Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/05988ebb-7378-4a3a-9d2d-30f8f58fe9ef
CVE ID: CVE-2021-24437 State: PUBLISHED Published: 2021-08-30T14:11:18 Last Updated: 2024-08-03T19:28:24.007Z Vendors: Unknown Products: Favicon by RealFaviconGenerator Problem Types: CWE-79 Description: The Favicon by RealFaviconGenerator WordPress plugin through 1.3.20 does not sanitise or escape one of its parameter before outputting it back in the response, leading to a Reflected Cross-Site Scripting (XSS) which is executed in the context of a logged administrator. Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/ed9d26be-cc96-4274-a05b-0b7ad9d8cfd9
CVE ID: CVE-2021-24438 State: PUBLISHED Published: 2021-08-30T14:11:19 Last Updated: 2024-08-03T19:28:24.005Z Vendors: Unknown Products: ShareThis Dashboard for Google Analytics Problem Types: CWE-79 Description: The ShareThis Dashboard for Google Analytics WordPress plugin before 2.5.2 does not sanitise or escape the 'ga_action' parameter in the stats view before outputting it back in an attribute when the plugin is connected to a Google Analytics account, leading to a reflected Cross-Site Scripting issue which will be executed in the context of a logged in administrator Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/af472879-9328-45c2-957f
dditional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/af472879-9328-45c2-957f-e7bed77e4c2d
CVE ID: CVE-2021-24439 State: PUBLISHED Published: 2021-07-12T19:21:01 Last Updated: 2024-08-03T19:28:23.951Z Vendors: Unknown Products: Browser Screenshots Problem Types: CWE-79 Description: The Browser Screenshots WordPress plugin before 1.7.6 allowed authenticated users with a role as low as Contributor to perform Stored Cross-Site Scripting attacks as the image_class parameter of the browser-shot shortcode was not escaped. Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/9c538c51-ae58-461d-b93b-cc9dfebf2bc0
CVE ID: CVE-2021-24440 State: PUBLISHED Published: 2021-07-12T19:21:02 Last Updated: 2024-08-03T19:28:24.002Z Vendors: Unknown Products: Sign-up Sheets Problem Types: CWE-79 Description: The Sign-up Sheets WordPress plugin before 1.0.14 did not sanitise or escape some of its fields when creating a new sheet, allowing high privilege users to add JavaScript in them, leading to a Stored Cross-Site Scripting issue. The payloads will be triggered when viewing the 'All Sheets' page in the admin dashboard Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/ba4503f7-684e-4274-bc53-3aa848712496
CVE ID: CVE-2021-24441 State: PUBLISHED Published: 2021-07-12T19:21:03 Last Updated: 2024-08-03T19:28:23.991Z Vendors: Unknown Products: Sign-up Sheets Problem Types: CWE-1236 Description: The Sign-up Sheets WordPress plugin before 1.0.14 does not not sanitise or validate the Sheet title when generating the CSV to export, which could lead to a CSV injection issue Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/ec9292b1-5cbd-4332-bdb6-2351c94f5ac6
CVE ID: CVE-2021-24442 State: PUBLISHED Published: 2021-07-12T19:21:04 Last Updated: 2024-08-03T19:28:23.964Z Vendors: wpdevart Products: Poll, Survey, Questionnaire and Voting system Problem Types: CWE-89 Description: The Poll, Survey, Questionnaire and Voting system WordPress plugin before 1.5.3 did not sanitise, escape or validate the date_answers[] POST parameter before using it in a SQL statement when sending a Poll result, allowing unauthenticated users to perform SQL Injection attacks Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/7376666e-9b2a-4239-b11f-8544435b444a - https://www.in-spired.xyz/wpdevart-polls-blind-sql-injection/
CVE ID: CVE-2021-24443 State: PUBLISHED Published: 2021-08-02T10:31:57 Last Updated: 2024-08-03T19:28:23.962Z Vendors: Unknown Products: Youzify – BuddyPress Community, User Profile, Social Network & Membership Plugin for WordPress Problem Types: CWE-79 Description: The About Me widget of the Youzify – BuddyPress Community, User Profile, Social Network & Membership WordPress plugin before 1.0.7 does not properly sanitise its Biography field, allowing any authenticated user to set Cross-Site Scripting payloads in it, which will be executed when viewing the affected user profile. This could allow a low privilege user to gain unauthorised access to the admin side of the blog by targeting an adm
ile. This could allow a low privilege user to gain unauthorised access to the admin side of the blog by targeting an admin, inducing them to view their profile with a malicious payload adding a rogue account for example. Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/a4432acd-df49-4a4f-8184-b55cdd5d4d34
CVE ID: CVE-2021-24444 State: PUBLISHED Published: 2021-08-02T00:00:00 Last Updated: 2024-08-03T19:28:23.965Z Vendors: Unknown Products: TaxoPress – Create and Manage Taxonomies, Tags, Categories Problem Types: CWE-79 Description: The TaxoPress – Create and Manage Taxonomies, Tags, Categories WordPress plugin before 3.0.7.2 does not sanitise its Taxonomy description field, allowing high privilege users to set JavaScript payload in them even when the unfiltered_html capability is disallowed, leading to an authenticated Stored Cross-Site Scripting issue. Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/a31321fe-adc6-4480-a220-35aedca52b8b - http
tes: - CVE Program Container: References: - https://wpscan.com/vulnerability/a31321fe-adc6-4480-a220-35aedca52b8b - http://packetstormsecurity.com/files/164604/WordPress-TaxoPress-3.0.7.1-Cross-Site-Scripting.html
CVE ID: CVE-2021-24445 State: PUBLISHED Published: 2021-08-16T10:48:20 Last Updated: 2024-08-03T19:28:23.810Z Vendors: Unknown Products: My Site Audit Problem Types: CWE-79 Description: The My Site Audit WordPress plugin through 1.2.4 does not sanitise or escape the Audit Name field when creating an audit, allowing high privilege users to set JavaScript payloads in them, even when he unfiltered_html capability is disallowed, leading to an authenticated Stored Cross-Site Scripting issue Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/d60634a3-ca39-43be-893b-ff9ba625360f
CVE ID: CVE-2021-24446 State: PUBLISHED Published: 2022-02-14T09:20:32 Last Updated: 2024-08-03T19:28:23.968Z Vendors: Unknown Products: Remove Footer Credit Problem Types: CWE-352 Description: The Remove Footer Credit WordPress plugin before 1.0.6 does not have CSRF check in place when saving its settings, which could allow attacker to make logged in admins change them and lead to Stored XSS issue as well due to the lack of sanitisation Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/be55131b-d9f2-4ac1-b667-c544c066887f
CVE ID: CVE-2021-24447 State: PUBLISHED Published: 2021-07-19T10:53:16 Last Updated: 2024-08-03T19:28:23.826Z Vendors: Unknown Products: WP Image Zoom Problem Types: CWE-22 Description: The WP Image Zoom WordPress plugin before 1.47 did not validate its tab parameter before using it in the include_once() function, leading to a local file inclusion issue in the admin dashboard Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/fb9dbcdf-4ffd-484d-9b67-283683d050fd
CVE ID: CVE-2021-24448 State: PUBLISHED Published: 2021-08-02T10:31:59 Last Updated: 2024-08-03T19:28:23.855Z Vendors: Unknown Products: User Registration & User Profile – Profile Builder Problem Types: CWE-79 Description: The User Registration & User Profile – Profile Builder WordPress plugin before 3.4.8 does not sanitise or escape its 'Modify default Redirect Delay timer' setting, allowing high privilege users to use JavaScript code in it, even when the unfiltered_html capability is disallowed, leading to an authenticated Stored Cross-Site Scripting issue Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/81e42812-93eb-480d-a2d2-5ba5e02dd0ba
CVE ID: CVE-2021-24450 State: PUBLISHED Published: 2021-08-02T10:32:00 Last Updated: 2024-08-03T19:28:23.962Z Vendors: Unknown Products: User Registration, User Profiles, Login & Membership – ProfilePress (Formerly WP User Avatar) Problem Types: CWE-79 Description: The User Registration, User Profiles, Login & Membership – ProfilePress (Formerly WP User Avatar) WordPress plugin before 3.1.8 did not sanitise or escape some of its settings before saving them and outputting them back in the page, allowing high privilege users such as admin to set JavaScript payloads in them even when the unfiltered_html capability is disallowed, leading to an authenticated Stored Cross-Site Scripting issue Addi
en when the unfiltered_html capability is disallowed, leading to an authenticated Stored Cross-Site Scripting issue Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/a8625579-fe8f-4bc1-a641-0e26ad141c92
CVE ID: CVE-2021-24451 State: PUBLISHED Published: 2021-07-06T11:03:34 Last Updated: 2024-08-03T19:28:23.930Z Vendors: Unknown Products: Export Users With Meta Problem Types: CWE-89 Description: The Export Users With Meta WordPress plugin before 0.6.5 did not escape the list of roles to export before using them in a SQL statement in the export functionality, available to admins, leading to an authenticated SQL Injection. Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/40603382-404b-44a2-8212-f2008366891c
CVE ID: CVE-2021-24452 State: PUBLISHED Published: 2021-07-19T10:53:17 Last Updated: 2024-08-03T19:28:23.950Z Vendors: BoldGrid Products: W3 Total Cache Problem Types: CWE-79 Description: The W3 Total Cache WordPress plugin before 2.1.5 was affected by a reflected Cross-Site Scripting (XSS) issue within the "extension" parameter in the Extensions dashboard, when the 'Anonymously track usage to improve product quality' setting is enabled, as the parameter is output in a JavaScript context without proper escaping. This could allow an attacker, who can convince an authenticated admin into clicking a link, to run malicious JavaScript within the user's web browser, which could lead to full site c
d admin into clicking a link, to run malicious JavaScript within the user's web browser, which could lead to full site compromise. Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/3e855e09-056f-45b5-89a9-d644b7d8c9d0
CVE ID: CVE-2021-24453 State: PUBLISHED Published: 2021-07-19T10:53:18 Last Updated: 2024-08-03T19:28:24.044Z Vendors: Unknown Products: Include Me Problem Types: CWE-22 Description: The Include Me WordPress plugin through 1.2.1 is vulnerable to path traversal / local file inclusion, which can lead to Remote Code Execution (RCE) of the system due to log poisoning and therefore potentially a full compromise of the underlying structure Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/78575072-4e04-4a8a-baec-f313cfffe829
CVE ID: CVE-2021-24454 State: PUBLISHED Published: 2021-07-12T19:21:05 Last Updated: 2024-08-03T19:35:18.675Z Vendors: Unknown Products: YOP Poll Problem Types: CWE-79 Description: In the YOP Poll WordPress plugin before 6.2.8, when a pool is created with the options "Allow other answers", "Display other answers in the result list" and "Show results", it can lead to Stored Cross-Site Scripting issues as the 'Other' answer is not sanitised before being output in the page. The execution of the XSS payload depends on the 'Show results' option selected, which could be before or after sending the vote for example. Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com
after sending the vote for example. Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/48ade7a5-5abb-4267-b9b6-13e31e1b3e91 - https://www.in-spired.xyz/discovering-wordpress-plugin-yop-polls-v6-2-7-stored-xss/
CVE ID: CVE-2021-24455 State: PUBLISHED Published: 2021-08-02T10:32:01 Last Updated: 2024-08-03T19:35:19.191Z Vendors: Unknown Products: Tutor LMS – eLearning and online course solution Problem Types: CWE-79 Description: The Tutor LMS – eLearning and online course solution WordPress plugin before 1.9.2 did not escape the Summary field of Announcements (when outputting it in an attribute), which can be created by users as low as Tutor Instructor. This lead to a Stored Cross-Site Scripting issue, which is triggered when viewing the Announcements list, and could result in privilege escalation when viewed by an admin. Additional Analyst Notes: - CVE Program Container: References: - https://wpsca
ilege escalation when viewed by an admin. Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/9ef14cf1-1e04-4125-a296-9aa5388612f9
CVE ID: CVE-2021-24456 State: PUBLISHED Published: 2021-08-02T10:32:02 Last Updated: 2024-08-03T19:35:19.195Z Vendors: Ays Pro Products: Quiz Maker Problem Types: CWE-89 Description: The Quiz Maker WordPress plugin before 6.2.0.9 did not properly sanitise and escape the order and orderby parameters before using them in SQL statements, leading to SQL injection issues in the admin dashboard Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/929ad37d-9cdb-4117-8cd3-cf7130a7c9d4
CVE ID: CVE-2021-24457 State: PUBLISHED Published: 2021-08-02T10:32:03 Last Updated: 2024-08-03T19:35:18.676Z Vendors: Ays Pro Products: Portfolio Responsive Gallery Problem Types: CWE-89 Description: The get_portfolios() and get_portfolio_attributes() functions in the class-portfolio-responsive-gallery-list-table.php and class-portfolio-responsive-gallery-attributes-list-table.php files of the Portfolio Responsive Gallery WordPress plugin before 1.1.8 did not use whitelist or validate the orderby parameter before using it in SQL statements passed to the get_results() DB calls, leading to SQL injection issues in the admin dashboard Additional Analyst Notes: - CVE Program Container: Reference
lls, leading to SQL injection issues in the admin dashboard Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/97f4f7da-22a8-42a6-88ac-82e95a6c06dd
CVE ID: CVE-2021-24458 State: PUBLISHED Published: 2021-08-02T10:32:03 Last Updated: 2024-08-03T19:35:18.675Z Vendors: Ays Pro Products: Popup box Problem Types: CWE-89 Description: The get_ays_popupboxes() and get_popup_categories() functions of the Popup box WordPress plugin before 2.3.4 did not use whitelist or validate the orderby parameter before using it in SQL statements passed to the get_results() DB calls, leading to SQL injection issues in the admin dashboard Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/8a588266-54cd-4779-adcf-f9b9e226c297
CVE ID: CVE-2021-24459 State: PUBLISHED Published: 2021-08-02T10:32:04 Last Updated: 2024-08-03T19:35:18.684Z Vendors: Ays Pro Products: Survey Maker Problem Types: CWE-89 Description: The get_results() and get_items() functions in the Survey Maker WordPress plugin before 1.5.6 did not use whitelist or validate the orderby parameter before using it in SQL statements passed to the get_results() DB calls, leading to SQL injection issues in the admin dashboard Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/3fafbec0-55e4-41cf-8402-1b57b6615225
CVE ID: CVE-2021-24460 State: PUBLISHED Published: 2021-08-02T10:32:06 Last Updated: 2024-08-03T19:35:19.691Z Vendors: Ays Pro Products: Popup Like box – Page Plugin Problem Types: CWE-89 Description: The get_fb_likeboxes() function in the Popup Like box – Page Plugin WordPress plugin before 3.5.3 did not use whitelist or validate the orderby parameter before using it in SQL statements passed to the get_results() DB calls, leading to SQL injection issues in the admin dashboard Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/9c0164f2-464b-4876-a48f-c0ebd63cf397
CVE ID: CVE-2021-24461 State: PUBLISHED Published: 2021-08-02T10:32:07 Last Updated: 2024-08-03T19:35:18.686Z Vendors: Ays Pro Products: FAQ Builder AYS Problem Types: CWE-89 Description: The get_faqs() function in the FAQ Builder AYS WordPress plugin before 1.3.6 did not use whitelist or validate the orderby parameter before using it in SQL statements passed to the get_results() DB calls, leading to SQL injection issues in the admin dashboard Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/311974b5-6d6e-4b47-a33d-6d8f468aa528