Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2021-24947 State: PUBLISHED Published: 2022-02-07T15:47:14 Last Updated: 2024-08-03T19:49:13.473Z Vendors: Unknown Products: RVM – Responsive Vector Maps Problem Types: CWE-863 Description: The RVM WordPress plugin before 6.4.2 does not have proper authorisation, CSRF checks and validation of the rvm_upload_regions_file_path parameter in the rvm_import_regions AJAX action, allowing any authenticated user, such as subscriber, to read arbitrary files on the web server Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/c6bb12b1-6961-40bd-9110-edfa9ee41a18
CVE ID: CVE-2021-24948 State: PUBLISHED Published: 2022-01-10T15:30:31 Last Updated: 2024-08-03T19:49:14.124Z Vendors: Unknown Products: The Plus Addons for Elementor - Pro Problem Types: CWE-200 Description: The Plus Addons for Elementor - Pro WordPress plugin before 5.0.7 does not validate the qvquery parameter of the tp_get_dl_post_info_ajax AJAX action, which could allow unauthenticated users to retrieve sensitive information, such as private and draft posts Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/2b67005a-476e-4772-b15c-3191911a50b0 - https://roadmap.theplusaddons.com/updates
CVE ID: CVE-2021-24949 State: PUBLISHED Published: 2022-01-10T15:30:31 Last Updated: 2024-08-03T19:49:13.413Z Vendors: Unknown Products: The Plus Addons for Elementor - Pro Problem Types: CWE-89 Description: The "WP Search Filters" widget of The Plus Addons for Elementor - Pro WordPress plugin before 5.0.7 does not sanitise and escape the option parameter before using it in a SQL statement, which could lead to SQL injection Additional Analyst Notes: - CVE Program Container: References: - https://roadmap.theplusaddons.com/updates - https://wpscan.com/vulnerability/9d7f8ba8-a5d5-4ec3-a48f-5cd4b115e8d5
CVE ID: CVE-2021-24950 State: PUBLISHED Published: 2022-03-14T14:41:01 Last Updated: 2024-08-03T19:49:13.971Z Vendors: Unknown Products: Insight Core Problem Types: CWE-862 Description: The Insight Core WordPress plugin through 1.0 does not have any authorisation and CSRF checks in the insight_customizer_options_import (available to any authenticated user), does not validate user input before passing it to unserialize(), nor sanitise and escape it before outputting it in the response. As a result, it could allow users with a role as low as Subscriber to perform PHP Object Injection, as well as Stored Cross-Site Scripting attacks Additional Analyst Notes: - CVE Program Container: References:
njection, as well as Stored Cross-Site Scripting attacks Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/01d430ea-ef85-4529-9ae4-c1f70016bb75
CVE ID: CVE-2021-24951 State: PUBLISHED Published: 2021-12-13T10:41:26 Last Updated: 2024-08-03T19:49:14.225Z Vendors: Unknown Products: LearnPress – WordPress LMS Plugin Problem Types: CWE-89 Description: The LearnPress WordPress plugin before 4.1.4 does not sanitise, validate and escape the id parameter before using it in SQL statements when duplicating course/lesson/quiz/question, leading to SQL Injections issues Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/0a16ddc5-5ab9-4a8f-86b5-41edcbeafc50
CVE ID: CVE-2021-24952 State: PUBLISHED Published: 2022-03-07T08:16:08 Last Updated: 2024-08-03T19:49:14.363Z Vendors: Unknown Products: Conversios.io – Google Analytics and Google Shopping plugin for WooCommerce Problem Types: CWE-89 Description: The Conversios.io WordPress plugin before 4.6.2 does not sanitise, validate and escape the sync_progressive_data parameter for the tvcajax_product_sync_bantch_wise AJAX action before using it in a SQL statement, allowing any authenticated user to perform SQL injection attacks. Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/cbb8fa9f-1c84-4410-ae86-64cb1771ce78
CVE ID: CVE-2021-24953 State: PUBLISHED Published: 2022-03-07T08:16:09 Last Updated: 2024-08-03T19:49:14.537Z Vendors: Unknown Products: Advanced iFrame Problem Types: CWE-79 Description: The Advanced iFrame WordPress plugin before 2022 does not sanitise and escape the ai_config_id parameter before outputting it back in an admin page, leading to a Reflected Cross-Site Scripting issue Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/0529261d-65e1-4c64-b8ed-ecb7356d9067
CVE ID: CVE-2021-24954 State: PUBLISHED Published: 2021-12-13T10:41:28 Last Updated: 2024-08-03T19:49:13.543Z Vendors: Unknown Products: User Registration, Login Form, User Profile & Membership – ProfilePress (Formerly WP User Avatar) Problem Types: CWE-79 Description: The User Registration, Login Form, User Profile & Membership WordPress plugin before 3.2.3 does not sanitise and escape the ppress_cc_data parameter before outputting it back in an attribute of an admin dashboard page, leading to a Reflected Cross-Site Scripting issue Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/54ff0db8-1d9e-4e67-b71a-142a9e5ed851 - https://plugins.trac.wor
ontainer: References: - https://wpscan.com/vulnerability/54ff0db8-1d9e-4e67-b71a-142a9e5ed851 - https://plugins.trac.wordpress.org/changeset/2626573/
CVE ID: CVE-2021-24955 State: PUBLISHED Published: 2021-12-13T10:41:29 Last Updated: 2024-08-03T19:49:13.992Z Vendors: Unknown Products: User Registration, Login Form, User Profile & Membership – ProfilePress (Formerly WP User Avatar) Problem Types: CWE-79 Description: The User Registration, Login Form, User Profile & Membership WordPress plugin before 3.2.3 does not escape the data parameter of the pp_get_forms_by_builder_type AJAX action before outputting it back in an attribute, leading to a Reflected Cross-Site Scripting issue Additional Analyst Notes: - CVE Program Container: References: - https://plugins.trac.wordpress.org/changeset/2626573/ - https://wpscan.com/vulnerability/e8005d4d-
tainer: References: - https://plugins.trac.wordpress.org/changeset/2626573/ - https://wpscan.com/vulnerability/e8005d4d-41c3-451d-b85a-2626decaa080
CVE ID: CVE-2021-24956 State: PUBLISHED Published: 2021-12-21T08:45:39 Last Updated: 2024-08-03T19:49:14.027Z Vendors: Unknown Products: Blog2Social: Social Media Auto Post & Scheduler Problem Types: CWE-79 Description: The Blog2Social: Social Media Auto Post & Scheduler WordPress plugin before 6.8.7 does not sanitise and escape the b2sShowByDate parameter before outputting it back in an admin page, leading to a Reflected Cross-Site Scripting issue Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/5882ea89-f463-4f0b-a624-150bbaf967c2
CVE ID: CVE-2021-24957 State: PUBLISHED Published: 2022-04-25T15:50:44 Last Updated: 2024-08-03T19:49:14.418Z Vendors: Unknown Products: Advanced Page Visit Counter – Advanced WordPress Visit Counter Problem Types: CWE-89 Description: The Advanced Page Visit Counter WordPress plugin before 6.1.6 does not escape the artID parameter before using it in a SQL statement in the apvc_reset_count_art AJAX action, available to any authenticated user, leading to a SQL injection Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/a282606f-6abf-4f75-99c9-dab0bea8cc96
CVE ID: CVE-2021-24958 State: PUBLISHED Published: 2022-03-14T14:41:03 Last Updated: 2024-08-03T19:49:13.964Z Vendors: Unknown Products: Meks Easy Photo Feed Widget Problem Types: CWE-79 Description: The Meks Easy Photo Feed Widget WordPress plugin before 1.2.4 does not have capability and CSRF checks in the meks_save_business_selected_account AJAX action, available to any authenticated user, and does not escape some of the settings. As a result, any authenticated user, such as subscriber could update the plugin's settings and put Cross-Site Scripting payloads in them Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/011c2519-fd84-4c95-b8b8-236
ional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/011c2519-fd84-4c95-b8b8-23654af59d70
CVE ID: CVE-2021-24959 State: PUBLISHED Published: 2022-03-14T14:41:05 Last Updated: 2024-08-03T19:49:13.934Z Vendors: Unknown Products: WP Email Users Problem Types: CWE-89 Description: The WP Email Users WordPress plugin through 1.7.6 does not escape the data_raw parameter in the weu_selected_users_1 AJAX action, available to any authenticated users, allowing them to perform SQL injection attacks. Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/0471d2e2-e759-468f-becd-0b062f00b435
CVE ID: CVE-2021-24960 State: PUBLISHED Published: 2022-03-07T08:16:10 Last Updated: 2024-08-03T19:49:13.982Z Vendors: Unknown Products: WordPress File Upload, wordpress-file-upload-pro Problem Types: CWE-434 Description: The WordPress File Upload WordPress plugin before 4.16.3, wordpress-file-upload-pro WordPress plugin before 4.16.3 allows users with a role as low as Contributor to configure the upload form in a way that allows uploading of SVG files, which could be then be used for Cross-Site Scripting attacks Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/18902832-2973-498d-808e-c75d1aedc11e - https://plugins.trac.wordpress.org/changeset
: - https://wpscan.com/vulnerability/18902832-2973-498d-808e-c75d1aedc11e - https://plugins.trac.wordpress.org/changeset/2677722
CVE ID: CVE-2021-24961 State: PUBLISHED Published: 2022-03-07T08:16:12 Last Updated: 2024-08-03T19:49:14.402Z Vendors: Unknown Products: WordPress File Upload, wordpress-file-upload-pro Problem Types: CWE-79 Description: The WordPress File Upload WordPress plugin before 4.16.3, wordpress-file-upload-pro WordPress plugin before 4.16.3 does not escape some of its shortcode argument, which could allow users with a role as low as Contributor to perform Cross-Site Scripting attacks Additional Analyst Notes: - CVE Program Container: References: - https://plugins.trac.wordpress.org/changeset/2677722 - https://wpscan.com/vulnerability/c911bbbd-0196-4e3d-ada3-4efb8a339954
CVE ID: CVE-2021-24962 State: PUBLISHED Published: 2022-03-28T17:21:01 Last Updated: 2024-08-03T19:49:14.540Z Vendors: Unknown Products: WordPress File Upload, WordPress File Upload Pro Problem Types: CWE-22 Description: The WordPress File Upload Free and Pro WordPress plugins before 4.16.3 allow users with a role as low as Contributor to perform path traversal via a shortcode argument, which can then be used to upload a PHP code disguised as an image inside the auto-loaded directory of the plugin, resulting in arbitrary code execution. Additional Analyst Notes: - CVE Program Container: References: - https://plugins.trac.wordpress.org/changeset/2677722 - https://wpscan.com/vulnerability/7a95
am Container: References: - https://plugins.trac.wordpress.org/changeset/2677722 - https://wpscan.com/vulnerability/7a95b3f2-285e-40e3-aead-41932c207623
CVE ID: CVE-2021-24963 State: PUBLISHED Published: 2022-01-03T12:49:07 Last Updated: 2024-08-03T19:49:14.342Z Vendors: Unknown Products: LiteSpeed Cache Problem Types: CWE-79 Description: The LiteSpeed Cache WordPress plugin before 4.4.4 does not escape the qc_res parameter before outputting it back in the JS code of an admin page, leading to a Reflected Cross-Site Scripting Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/7f8b4275-7586-4e04-afd9-d12bdab6ba9b - https://plugins.trac.wordpress.org/changeset/2634373
CVE ID: CVE-2021-24964 State: PUBLISHED Published: 2022-01-03T12:49:08.000Z Last Updated: 2025-05-22T18:39:45.298Z Vendors: Unknown Products: LiteSpeed Cache Problem Types: CWE-79 Description: The LiteSpeed Cache WordPress plugin before 4.4.4 does not properly verify that requests are coming from QUIC.cloud servers, allowing attackers to make requests to certain endpoints by using a specific X-Forwarded-For header value. In addition, one of the endpoint could be used to set CSS code if a setting is enabled, which will then be output in some pages without being sanitised and escaped. Combining those two issues, an unauthenticated attacker could put Cross-Site Scripting payloads in pages visit
escaped. Combining those two issues, an unauthenticated attacker could put Cross-Site Scripting payloads in pages visited by users. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/e9966b3e-2eb9-4d70-8c18-6a829b4827cc
CVE ID: CVE-2021-24965 State: PUBLISHED Published: 2022-01-24T08:00:57 Last Updated: 2024-08-03T19:49:14.377Z Vendors: Unknown Products: Five Star Restaurant Reservations – WordPress Booking Plugin Problem Types: CWE-79 Description: The Five Star Restaurant Reservations WordPress plugin before 2.4.8 does not have capability and CSRF checks in the rtb_welcome_set_schedule AJAX action, allowing any authenticated users to call it. Due to the lack of sanitisation and escaping, users with a role as low as subscriber could perform Cross-Site Scripting attacks against logged in admins Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/306ecf09-fdf0-449
mins Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/306ecf09-fdf0-449c-930c-9dfa58f0efc2
CVE ID: CVE-2021-24966 State: PUBLISHED Published: 2022-03-14T14:41:06 Last Updated: 2024-08-03T19:49:14.380Z Vendors: Unknown Products: Error Log Viewer by BestWebSoft Problem Types: CWE-73 Description: The Error Log Viewer WordPress plugin through 1.1.1 does not validate the path of the log file to clear, allowing high privilege users to clear arbitrary files on the web server, including those outside of the blog folder Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/166a4f88-4f0c-4bf4-b624-5e6a02e21fa0
CVE ID: CVE-2021-24967 State: PUBLISHED Published: 2021-12-27T10:33:21 Last Updated: 2024-08-03T19:49:14.104Z Vendors: Unknown Products: Contact Form & Lead Form Elementor Builder Problem Types: CWE-79 Description: The Contact Form & Lead Form Elementor Builder WordPress plugin before 1.6.4 does not sanitise and escape some lead values, which could allow unauthenticated users to perform Cross-Site Scripting attacks against logged in admin viewing the inserted Leads Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/4e165122-4746-42de-952e-a3bf51393a74
CVE ID: CVE-2021-24968 State: PUBLISHED Published: 2022-01-24T08:00:59 Last Updated: 2024-08-03T19:49:14.382Z Vendors: Unknown Products: Ultimate FAQ – WordPress FAQ and Accordion Plugin Problem Types: CWE-862 Description: The Ultimate FAQ WordPress plugin before 2.1.2 does not have capability and CSRF checks in the ewd_ufaq_welcome_add_faq and ewd_ufaq_welcome_add_faq_page AJAX actions, available to any authenticated users. As a result, any users, with a role as low as Subscriber could create FAQ and FAQ questions Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/f0a9e6cc-46cc-4ac2-927a-c006b8e8aa68 - https://plugins.trac.wordpress.org/changes
es: - https://wpscan.com/vulnerability/f0a9e6cc-46cc-4ac2-927a-c006b8e8aa68 - https://plugins.trac.wordpress.org/changeset/2648562
CVE ID: CVE-2021-24969 State: PUBLISHED Published: 2021-12-27T10:33:21 Last Updated: 2024-08-03T19:49:14.022Z Vendors: Unknown Products: WordPress Download Manager Problem Types: CWE-79 Description: The WordPress Download Manager WordPress plugin before 3.2.22 does not sanitise and escape Template data before outputting it in various pages (such as admin dashboard and frontend). Due to the lack of authorisation and CSRF checks in the wpdm_save_template AJAX action, any authenticated users such as subscriber is able to call it and perform Cross-Site Scripting attacks Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/01144c50-54ca-44d9-9ce8-bf4f6
nal Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/01144c50-54ca-44d9-9ce8-bf4f659114ee
CVE ID: CVE-2021-24970 State: PUBLISHED Published: 2021-12-13T10:41:31 Last Updated: 2024-08-03T19:49:14.106Z Vendors: Unknown Products: All-in-One Video Gallery Problem Types: CWE-22 Description: The All-in-One Video Gallery WordPress plugin before 2.5.0 does not sanitise and validate the tab parameter before using it in a require statement in the admin dashboard, leading to a Local File Inclusion issue Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/9b15d47e-43b6-49a8-b2c3-b99c92101e10
CVE ID: CVE-2021-24971 State: PUBLISHED Published: 2022-02-28T09:06:24 Last Updated: 2024-08-03T19:49:14.149Z Vendors: Unknown Products: WP Responsive Menu Problem Types: CWE-79 Description: The WP Responsive Menu WordPress plugin before 3.1.7.1 does not have capability and CSRF checks in the wpr_live_update AJAX action, as well as do not sanitise and escape some of the data submitted. As a result, any authenticated, such as subscriber could update the plugin's settings and perform Cross-Site Scripting attacks against all visitor and users on the frontend Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/661cb7e3-d7bd-4bc1-bf78-bdb4ba9610d7
CVE ID: CVE-2021-24972 State: PUBLISHED Published: 2021-12-13T10:41:32 Last Updated: 2024-08-03T19:49:14.378Z Vendors: Unknown Products: Pixel Cat – Conversion Pixel Manager Problem Types: CWE-79 Description: The Pixel Cat WordPress plugin before 2.6.3 does not escape some of its settings, which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html is disallowed Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/b960cb36-62de-4b9f-a35d-144a34a4c63d
CVE ID: CVE-2021-24973 State: PUBLISHED Published: 2022-01-03T12:49:09 Last Updated: 2024-08-03T19:49:14.017Z Vendors: Unknown Products: Site Reviews Problem Types: CWE-79 Description: The Site Reviews WordPress plugin before 5.17.3 does not sanitise and escape the site-reviews parameter of the glsr_action AJAX action (available to unauthenticated and any authenticated users), allowing them to perform Cross-Site Scripting attacks against logged in admins viewing the Tool dashboard of the plugin Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/0118f245-0e6f-44c1-9bdb-5b3a5d2403d6 - https://plugins.trac.wordpress.org/changeset/2629821
CVE ID: CVE-2021-24974 State: PUBLISHED Published: 2022-01-24T08:01:00 Last Updated: 2024-08-03T19:49:14.388Z Vendors: Unknown Products: Product Feed PRO for WooCommerce Problem Types: CWE-79 Description: The Product Feed PRO for WooCommerce WordPress plugin before 11.0.7 does not have authorisation and CSRF check in some of its AJAX actions, allowing any authenticated users to call then, which could lead to Stored Cross-Site Scripting issue (which will be triggered in the admin dashboard) due to the lack of escaping. Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/8ed549fe-7d27-4a7a-b226-c20252964b29
CVE ID: CVE-2021-24975 State: PUBLISHED Published: 2022-02-01T12:21:33 Last Updated: 2024-08-03T19:49:14.049Z Vendors: Unknown Products: NextScripts: Social Networks Auto-Poster Problem Types: CWE-79 Description: The NextScripts: Social Networks Auto-Poster WordPress plugin before 4.3.24 does not sanitise and escape logged requests before outputting them in the related admin dashboard, leading to an Unauthenticated Stored Cross-Site Scripting issue Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/b99dae3d-8230-4427-adc5-4ef9cbfb8ba1 - https://plugins.trac.wordpress.org/changeset/2650138
CVE ID: CVE-2021-24976 State: PUBLISHED Published: 2022-01-24T08:01:02 Last Updated: 2024-08-03T19:49:14.366Z Vendors: Unknown Products: Smart SEO Tool – SEO优化插件 Problem Types: CWE-79 Description: The Smart SEO Tool WordPress plugin before 3.0.6 does not sanitise and escape the search parameter before outputting it back in an attribute when the TDK optimisation setting is enabled, leading to a Reflected Cross-Site Scripting Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/7d5f58a8-bee4-46be-9c08-d272678338f0 - https://plugins.trac.wordpress.org/changeset/2637305
CVE ID: CVE-2021-24977 State: PUBLISHED Published: 2022-02-28T09:06:26 Last Updated: 2024-08-03T19:49:14.458Z Vendors: Unknown Products: Use Any Font | Custom Font Uploader Problem Types: CWE-862 Description: The Use Any Font | Custom Font Uploader WordPress plugin before 6.2.1 does not have any authorisation checks when assigning a font, allowing unauthenticated users to sent arbitrary CSS which will then be processed by the frontend for all users. Due to the lack of sanitisation and escaping in the backend, it could also lead to Stored XSS issues Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/739831e3-cdfb-4a22-9abf-6c594d7e3d75
CVE ID: CVE-2021-24978 State: PUBLISHED Published: 2022-03-28T17:21:15 Last Updated: 2024-08-03T19:49:14.082Z Vendors: Unknown Products: OSMapper Problem Types: CWE-862 Description: The OSMapper WordPress plugin through 2.1.5 contains an AJAX action to delete a plugin related post type named 'map' and is registered with the wp_ajax_nopriv prefix, making it available to unauthenticated users. There is no authorisation, CSRF and checks in place to ensure that the post to delete is a map one. As a result, unauthenticated user can delete arbitrary posts from the blog Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/f0f2af29-e21e-4d16-9424-1a49bff7
Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/f0f2af29-e21e-4d16-9424-1a49bff7fb86
CVE ID: CVE-2021-24979 State: PUBLISHED Published: 2021-12-27T10:33:22 Last Updated: 2024-08-03T19:49:14.417Z Vendors: Unknown Products: Paid Memberships Pro Problem Types: CWE-79 Description: The Paid Memberships Pro WordPress plugin before 2.6.6 does not escape the s parameter before outputting it back in an attribute in an admin page, leading to a Reflected Cross-Site Scripting Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/fc011990-4ec1-4553-901d-4ff1f482cb79 - https://plugins.trac.wordpress.org/changeset/2632369/paid-memberships-pro/tags/2.6.6/adminpages/discountcodes.php
CVE ID: CVE-2021-24980 State: PUBLISHED Published: 2021-12-27T10:33:23 Last Updated: 2024-08-03T19:49:14.367Z Vendors: Unknown Products: Gwolle Guestbook Problem Types: CWE-79 Description: The Gwolle Guestbook WordPress plugin before 4.2.0 does not sanitise and escape the gwolle_gb_user_email parameter before outputting it back in an attribute, leading to a Reflected Cross-Site Scripting issue in an admin page Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/e50bcb39-9a01-433f-81b3-fd4018672b85
CVE ID: CVE-2021-24981 State: PUBLISHED Published: 2021-12-21T08:45:40 Last Updated: 2024-08-03T19:49:14.417Z Vendors: Unknown Products: Directorist – Business Directory Plugin Problem Types: CWE-434, CWE-352 Description: The Directorist WordPress plugin before 7.0.6.2 was vulnerable to Cross-Site Request Forgery to Remote File Upload leading to arbitrary PHP shell uploads in the wp-content/plugins directory. Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/4c45df6d-b3f6-49e5-8b1f-edd32a12d71c - https://blog.sucuri.net/2021/11/fake-ransomware-infection-spooks-website-owners.html