Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2021-25059 State: PUBLISHED Published: 2022-11-28T13:47:09.324Z Last Updated: 2025-04-25T15:03:10.128Z Vendors: Unknown Products: Download Plugin Problem Types: CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') Description: The Download Plugin WordPress plugin before 2.0.0 does not properly validate a user has the required privileges to access a backup's nonce identifier, which may allow any users with an account on the site (such as subscriber) to download a full copy of the website. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/b125a765-a6b6-421b-bd8a-effec12bc629
CVE ID: CVE-2021-25060 State: PUBLISHED Published: 2022-02-21T10:45:47 Last Updated: 2024-08-03T19:49:14.632Z Vendors: Unknown Products: Five Star Business Profile and Schema Problem Types: CWE-79 Description: The Five Star Business Profile and Schema WordPress plugin before 2.1.7 does not have any authorisation and CSRF in its bpfwp_welcome_add_contact_page and bpfwp_welcome_set_contact_information AJAX action, allowing any authenticated users, such as subscribers, to call them. Furthermore, due to the lack of sanitisation, it also lead to Stored Cross-Site Scripting issues Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/9e1ac711-1f65-49fa-b
s Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/9e1ac711-1f65-49fa-b007-66170a77b265
CVE ID: CVE-2021-25061 State: PUBLISHED Published: 2022-01-17T13:00:39 Last Updated: 2024-08-03T19:49:14.594Z Vendors: Unknown Products: WP Booking System – Booking Calendar Problem Types: CWE-79 Description: The WP Booking System WordPress plugin before 2.0.15 was affected by a reflected xss in wp-booking-system on the wpbs-calendars admin page. Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/bd9dc754-08a4-4bfc-8dda-3f5c0e070f7e - https://plugins.trac.wordpress.org/changeset/2643776/wp-booking-system
CVE ID: CVE-2021-25062 State: PUBLISHED Published: 2022-01-24T08:01:20 Last Updated: 2024-08-03T19:49:14.549Z Vendors: Unknown Products: Orders Tracking for WooCommerce Problem Types: CWE-79 Description: The Orders Tracking for WooCommerce WordPress plugin before 1.1.10 does not sanitise and escape the file_url before outputting it back in an admin page, leading to a Reflected Cross-Site Scripting Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/dc9a5d36-7453-46a8-a17f-712449d7987d - https://plugins.trac.wordpress.org/changeset/2643807
CVE ID: CVE-2021-25063 State: PUBLISHED Published: 2022-02-01T12:21:35 Last Updated: 2024-08-03T19:49:14.629Z Vendors: Unknown Products: Skins for Contact Form 7 Problem Types: CWE-79 Description: The Skins for Contact Form 7 WordPress plugin before 2.5.1 does not sanitise and escape the tab parameter before outputting it back in an admin page, leading to a Reflected Cross-Site Scripting Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/e2185887-3e53-4089-aa3f-981c944ee0bb
CVE ID: CVE-2021-25064 State: PUBLISHED Published: 2022-03-28T17:21:42 Last Updated: 2024-08-03T19:49:14.581Z Vendors: Unknown Products: Wow Countdowns – easily create any countdowns, counters and timers Problem Types: CWE-89 Description: The Wow Countdowns WordPress plugin through 3.1.2 does not sanitize user input into the 'did' parameter and uses it in a SQL statement, leading to an authenticated SQL Injection. Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/30c70315-3c17-41f0-a12f-7e3f793e259c
CVE ID: CVE-2021-25065 State: PUBLISHED Published: 2022-01-17T13:00:40 Last Updated: 2024-08-03T19:56:09.480Z Vendors: Unknown Products: Smash Balloon Social Post Feed Problem Types: CWE-79 Description: The Smash Balloon Social Post Feed WordPress plugin before 4.1.1 was affected by a reflected XSS in custom-facebook-feed in cff-top admin page. Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/ae1aab4e-b00a-458b-a176-85761655bdcc
CVE ID: CVE-2021-25066 State: PUBLISHED Published: 2022-07-04T13:05:27 Last Updated: 2024-08-03T19:56:09.479Z Vendors: Unknown Products: Ninja Forms Contact Form – The Drag and Drop Form Builder for WordPress Problem Types: CWE-79 Description: The Ninja Forms Contact Form WordPress plugin before 3.6.10 does not sanitize and escape some imported data, allowing high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed. Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/323d5fd0-abe8-44ef-9127-eea6fd4f3f3d
CVE ID: CVE-2021-25067 State: PUBLISHED Published: 2022-01-17T13:00:41 Last Updated: 2024-08-03T19:56:09.465Z Vendors: Unknown Products: Landing Page Builder – Lead Page – Optin Page – Squeeze Page – WordPress Landing Pages Problem Types: CWE-79 Description: The Landing Page Builder WordPress plugin before 1.4.9.6 was affected by a reflected XSS in page-builder-add on the ulpb_post admin page. Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/365007f0-61ac-4e81-8a3a-3a068f2c84bc
CVE ID: CVE-2021-25068 State: PUBLISHED Published: 2022-03-28T17:21:55 Last Updated: 2024-08-03T19:56:09.944Z Vendors: Unknown Products: Sync WooCommerce Product feed to Google Shopping Problem Types: CWE-89 Description: The Sync WooCommerce Product feed to Google Shopping WordPress plugin through 1.2.4 uses the 'feed_id' POST parameter which is not properly sanitized for use in a SQL statement, leading to a SQL injection vulnerability in the admin dashboard Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/32799efd-99dc-46dd-8648-e9eb872a0371
CVE ID: CVE-2021-25069 State: PUBLISHED Published: 2022-02-21T10:45:48 Last Updated: 2024-08-03T19:56:09.477Z Vendors: Unknown Products: Download Manager Problem Types: CWE-89 Description: The Download Manager WordPress plugin before 3.2.34 does not sanitise and escape the package_ids parameter before using it in a SQL statement, leading to a SQL injection, which can also be exploited to cause a Reflected Cross-Site Scripting issue Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/4ff5e638-1b89-41df-b65a-f821de8934e8 - https://plugins.trac.wordpress.org/changeset/2656086
CVE ID: CVE-2021-25070 State: PUBLISHED Published: 2022-03-28T17:22:09 Last Updated: 2024-08-03T19:56:09.968Z Vendors: Unknown Products: Block Bad Bots and Stop Bad Bots Crawlers and Spiders and Anti Spam Protection Problem Types: CWE-89 Description: The Block Bad Bots WordPress plugin before 6.88 does not properly sanitise and escape the User Agent before using it in a SQL statement to record logs, leading to an SQL Injection issue Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/e00b2946-15e5-4458-9b13-2e272630a36f
CVE ID: CVE-2021-25071 State: PUBLISHED Published: 2022-03-28T17:22:23 Last Updated: 2024-08-03T19:56:09.956Z Vendors: Unknown Products: Akismet Privacy Policies Problem Types: CWE-79 Description: The WordPress plugin through 2.0.1 does not sanitise and escape the translation parameter before outputting it back in an admin page, leading to a Reflected Cross-Site Scripting Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/53085936-fa07-4f00-a7dc-bbe98c51320e
CVE ID: CVE-2021-25072 State: PUBLISHED Published: 2022-02-01T12:21:35 Last Updated: 2024-08-03T19:56:09.925Z Vendors: Unknown Products: NextScripts: Social Networks Auto-Poster Problem Types: CWE-352 Description: The NextScripts: Social Networks Auto-Poster WordPress plugin before 4.3.25 does not have CSRF check in place when deleting items, allowing attacker to make a logged in admin delete arbitrary posts via a CSRF attack Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/53d2c61d-ce73-40e0-a113-9d76d8fecc91
CVE ID: CVE-2021-25073 State: PUBLISHED Published: 2022-01-24T08:01:21 Last Updated: 2024-08-03T19:56:09.922Z Vendors: Unknown Products: WP125 Problem Types: CWE-352 Description: The WP125 WordPress plugin before 1.5.5 does not have CSRF checks in various action, for example when deleting an ad, allowing attackers to make a logged in admin delete them via a CSRF attack Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/922a2037-9b5e-4c94-83d9-99efc494e9e2 - https://plugins.trac.wordpress.org/changeset/2647594
CVE ID: CVE-2021-25074 State: PUBLISHED Published: 2022-01-24T08:01:22 Last Updated: 2024-08-03T19:56:09.466Z Vendors: Unknown Products: WebP Converter for Media – Convert WebP and AVIF & Optimize Images Problem Types: CWE-601 Description: The WebP Converter for Media WordPress plugin before 4.0.3 contains a file (passthru.php) which does not validate the src parameter before redirecting the user to it, leading to an Open Redirect issue Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/f3c0a155-9563-4533-97d4-03b9bac83164
CVE ID: CVE-2021-25075 State: PUBLISHED Published: 2022-02-21T10:45:50 Last Updated: 2024-08-03T19:56:09.985Z Vendors: Unknown Products: Duplicate Page or Post Problem Types: CWE-862 Description: The Duplicate Page or Post WordPress plugin before 1.5.1 does not have any authorisation and has a flawed CSRF check in the wpdevart_duplicate_post_parametrs_save_in_db AJAX action, allowing any authenticated users, such as subscriber to call it and change the plugin's settings, or perform such attack via CSRF. Furthermore, due to the lack of escaping, this could lead to Stored Cross-Site Scripting issues Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerabili
ss-Site Scripting issues Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/db5a0431-af4d-45b7-be4e-36b6c90a601b
CVE ID: CVE-2021-25076 State: PUBLISHED Published: 2022-01-24T08:01:24 Last Updated: 2024-08-03T19:56:09.883Z Vendors: Unknown Products: WP User Frontend – Membership, Profile, Registration & Post Submission Plugin for WordPress Problem Types: CWE-89 Description: The WP User Frontend WordPress plugin before 3.5.26 does not validate and escape the status parameter before using it in a SQL statement in the Subscribers dashboard, leading to an SQL injection. Due to the lack of sanitisation and escaping, this could also lead to Reflected Cross-Site Scripting Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/6d3eeba6-5560-4380-a6e9-f008a9112ac6 - ht
Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/6d3eeba6-5560-4380-a6e9-f008a9112ac6 - https://plugins.trac.wordpress.org/changeset/2648715 - http://packetstormsecurity.com/files/166071/WordPress-WP-User-Frontend-3.5.25-SQL-Injection.html
CVE ID: CVE-2021-25077 State: PUBLISHED Published: 2022-02-07T15:47:17 Last Updated: 2024-08-03T19:56:10.226Z Vendors: Unknown Products: Store Toolkit for WooCommerce Problem Types: CWE-79 Description: The Store Toolkit for WooCommerce WordPress plugin before 2.3.2 does not sanitise and escape the tab parameter before outputting it back in an admin page in an error message, leading to a Reflected Cross-Site Scripting Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/53868650-aba0-4d07-89d2-a998bb0ee5f6 - https://plugins.trac.wordpress.org/changeset/2654503
CVE ID: CVE-2021-25078 State: PUBLISHED Published: 2022-01-24T08:01:25 Last Updated: 2024-08-03T19:56:09.889Z Vendors: Unknown Products: Affiliates Manager Problem Types: CWE-79 Description: The Affiliates Manager WordPress plugin before 2.9.0 does not validate, sanitise and escape the IP address of requests logged by the click tracking feature, allowing unauthenticated attackers to perform Cross-Site Scripting attacks against admin viewing the tracked requests. Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/d4edb5f2-aa1b-4e2d-abb4-76c46def6c6e - https://plugins.trac.wordpress.org/changeset/2648196
CVE ID: CVE-2021-25079 State: PUBLISHED Published: 2022-01-24T08:01:27 Last Updated: 2024-08-03T19:56:09.871Z Vendors: Unknown Products: Contact Form Entries – Contact Form 7, WPforms and more Problem Types: CWE-79 Description: The Contact Form Entries WordPress plugin before 1.2.4 does not sanitise and escape various parameters, such as form_id, status, end_date, order, orderby and search before outputting them back in the admin page Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/c3d49271-9656-4428-8357-0d1d77b7fc63 - https://plugins.trac.wordpress.org/changeset/2629442
CVE ID: CVE-2021-25080 State: PUBLISHED Published: 2022-01-24T08:01:28 Last Updated: 2024-08-03T19:56:09.996Z Vendors: Unknown Products: Contact Form Entries – Contact Form 7, WPforms and more Problem Types: CWE-79 Description: The Contact Form Entries WordPress plugin before 1.1.7 does not validate, sanitise and escape the IP address retrieved via headers such as CLIENT-IP and X-FORWARDED-FOR, allowing unauthenticated attackers to perform Cross-Site Scripting attacks against logged in admins viewing the created entry Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/acd3d98a-aab8-49be-b77e-e8c6ede171ac - https://plugins.trac.wordpress.org/chan
ences: - https://wpscan.com/vulnerability/acd3d98a-aab8-49be-b77e-e8c6ede171ac - https://plugins.trac.wordpress.org/changeset/2450335
CVE ID: CVE-2021-25081 State: PUBLISHED Published: 2022-02-28T09:06:35 Last Updated: 2024-08-03T19:56:10.996Z Vendors: Unknown Products: Maps Plugin using Google Maps for WordPress – WP Google Map Problem Types: CWE-352 Description: The Maps Plugin using Google Maps for WordPress plugin before 1.8.4 does not have CSRF checks in most of its AJAX actions, which could allow attackers to make logged in admins delete arbitrary posts and update the plugin's settings via a CSRF attack Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/f85cf258-1c2f-444e-91e5-b1fc55880f0e - https://plugins.trac.wordpress.org/changeset/2667376
CVE ID: CVE-2021-25082 State: PUBLISHED Published: 2022-02-21T10:45:51 Last Updated: 2024-08-03T19:56:09.873Z Vendors: Unknown Products: Popup Builder – Create highly converting, mobile friendly marketing popups. Problem Types: CWE-22 Description: The Popup Builder WordPress plugin before 4.0.7 does not validate and sanitise the sgpb_type parameter before using it in a require statement, leading to a Local File Inclusion issue. Furthermore, since the beginning of the string can be controlled, the issue can lead to RCE vulnerability via wrappers such as PHAR Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/0f90f10c-4b0a-46da-ac1f-aa6a03312132 -
st Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/0f90f10c-4b0a-46da-ac1f-aa6a03312132 - https://plugins.trac.wordpress.org/changeset/2659117
CVE ID: CVE-2021-25083 State: PUBLISHED Published: 2022-01-24T08:01:29 Last Updated: 2024-08-03T19:56:09.977Z Vendors: Unknown Products: Registrations for the Events Calendar – Event Registration Plugin Problem Types: CWE-79 Description: The Registrations for the Events Calendar WordPress plugin before 2.7.10 does not escape the qtype parameter before outputting it back in an attribute in the settings page, leading to a Reflected Cross-Site Scripting Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/9b69544d-6a08-4757-901b-6ccf1cd00ecc - https://plugins.trac.wordpress.org/changeset/2648377
CVE ID: CVE-2021-25084 State: PUBLISHED Published: 2022-02-07T15:47:18 Last Updated: 2024-08-03T19:56:09.878Z Vendors: Unknown Products: Advanced Cron Manager, Advanced Cron Manager Pro Problem Types: CWE-862 Description: The Advanced Cron Manager WordPress plugin before 2.4.2 and Advanced Cron Manager Pro WordPress plugin before 2.5.3 do not have authorisation checks in some of their AJAX actions, allowing any authenticated users, such as subscriber to call them and add or remove events as well as schedules for example Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/7c5c602f-499f-431b-80bc-507053984a06
CVE ID: CVE-2021-25085 State: PUBLISHED Published: 2022-02-01T12:21:36 Last Updated: 2024-08-03T19:56:09.874Z Vendors: Unknown Products: WOOF – Products Filter for WooCommerce Problem Types: CWE-79 Description: The WOOF WordPress plugin before 1.2.6.3 does not sanitise and escape the woof_redraw_elements before outputing back in an admin page, leading to a Reflected Cross-Site Scripting Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/b7dd81c6-6af1-4976-b928-421ca69bfa90 - https://plugins.trac.wordpress.org/changeset/2648751
CVE ID: CVE-2021-25086 State: PUBLISHED Published: 2022-05-02T16:05:31 Last Updated: 2024-08-03T19:56:09.909Z Vendors: Unknown Products: Advanced Page Visit Counter – Advanced WordPress Visit Counter Problem Types: CWE-79 Description: The Advanced Page Visit Counter WordPress plugin before 6.1.2 does not sanitise and escape some input before outputting it in an admin dashboard page, allowing unauthenticated attackers to perform Cross-Site Scripting attacks against admins viewing it Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/2cf9e517-d882-4af2-bd12-e700b75e7a11
CVE ID: CVE-2021-25087 State: PUBLISHED Published: 2022-03-07T08:16:18 Last Updated: 2024-08-03T19:56:09.993Z Vendors: Unknown Products: Download Manager Problem Types: CWE-862 Description: The Download Manager WordPress plugin before 3.2.35 does not have any authorisation checks in some of the REST API endpoints, allowing unauthenticated attackers to call them, which could lead to sensitive information disclosure, such as posts passwords (fixed in 3.2.24) and files Master Keys (fixed in 3.2.25). Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/d7ceafae-65ec-4e05-9ed1-59470771bf07
CVE ID: CVE-2021-25088 State: PUBLISHED Published: 2022-06-20T10:25:40 Last Updated: 2024-08-03T19:56:09.909Z Vendors: Unknown Products: XML Sitemaps Problem Types: CWE-79 Description: The XML Sitemaps WordPress plugin before 4.1.3 does not sanitise and escape a settings before outputting it in the Debug page, which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup) Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/820c51d6-186e-4d63-b4a7-bd0a59c02cc8
CVE ID: CVE-2021-25089 State: PUBLISHED Published: 2022-02-01T12:21:37 Last Updated: 2024-08-03T19:56:10.476Z Vendors: Unknown Products: UpdraftPlus WordPress Backup Plugin Problem Types: CWE-79 Description: The UpdraftPlus WordPress Backup Plugin WordPress plugin before 1.16.69 does not sanitise and escape the updraft_restore parameter before outputting it back in the Restore page, leading to a Reflected Cross-Site Scripting Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/5adb977e-f7bf-4d36-b625-87bc23d379c8
CVE ID: CVE-2021-25090 State: PUBLISHED Published: 2022-04-11T14:40:38 Last Updated: 2024-08-03T19:56:10.579Z Vendors: Unknown Products: Portfolio Gallery, Product Catalog – Grid KIT Portfolio Problem Types: CWE-79 Description: The Portfolio Gallery, Product Catalog WordPress plugin before 2.1.0 does not have authorisation and CSRF checks in various functions related to AJAX actions, allowing any authenticated users, such as subscriber, to call them. Due to the lack of sanitisation and escaping, it could also allows attackers to perform Cross-Site Scripting attacks on pages where a Portfolio is embed Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerab
where a Portfolio is embed Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/32a4a2b5-ef65-4e29-af4a-f003dbd0809c
CVE ID: CVE-2021-25091 State: PUBLISHED Published: 2022-02-01T12:21:38 Last Updated: 2024-08-03T19:56:09.858Z Vendors: Unknown Products: Link Library Problem Types: CWE-79 Description: The Link Library WordPress plugin before 7.2.9 does not sanitise and escape the settingscopy parameter before outputting it back in an admin page, leading to a Reflected Cross-Site Scripting Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/96204946-0b10-4a2c-8079-473883ff95b6
CVE ID: CVE-2021-25092 State: PUBLISHED Published: 2022-02-01T12:21:39 Last Updated: 2024-08-03T19:56:10.620Z Vendors: Unknown Products: Link Library Problem Types: CWE-352 Description: The Link Library WordPress plugin before 7.2.8 does not have CSRF check when resetting library settings, allowing attackers to make a logged in admin reset arbitrary settings via a CSRF attack Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/1cd30913-67c7-46c3-a2de-dcca0c332323
CVE ID: CVE-2021-25093 State: PUBLISHED Published: 2022-02-01T12:21:39 Last Updated: 2024-08-03T19:56:09.879Z Vendors: Unknown Products: Link Library Problem Types: CWE-862 Description: The Link Library WordPress plugin before 7.2.8 does not have authorisation in place when deleting links, allowing unauthenticated users to delete arbitrary links via a crafted request Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/7a7603ce-d76d-4c49-a886-67653bed8cd3
CVE ID: CVE-2021-25094 State: PUBLISHED Published: 2022-04-25T15:50:46.000Z Last Updated: 2025-04-21T15:04:51.317Z Vendors: Unknown Products: Tatsu Problem Types: CWE-306 Description: The Tatsu WordPress plugin before 3.3.12 add_custom_font action can be used without prior authentication to upload a rogue zip file which is uncompressed under the WordPress's upload directory. By adding a PHP shell with a filename starting with a dot ".", this can bypass extension control implemented in the plugin. Moreover, there is a race condition in the zip extraction process which makes the shell file live long enough on the filesystem to be callable by an attacker. Additional Analyst Notes: - CVE Program
the shell file live long enough on the filesystem to be callable by an attacker. Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/fb0097a0-5d7b-4e5b-97de-aacafa8fffcd - https://darkpills.com/wordpress-tatsu-builder-preauth-rce-cve-2021-25094/ - http://packetstormsecurity.com/files/167190/WordPress-Tatsu-Builder-Remote-Code-Execution.html
CVE ID: CVE-2021-25095 State: PUBLISHED Published: 2022-02-07T00:00:00 Last Updated: 2024-08-03T19:56:09.905Z Vendors: Unknown Products: IP2Location Country Blocker Problem Types: CWE-352, CWE-862 Description: The IP2Location Country Blocker WordPress plugin before 2.26.5 does not have authorisation and CSRF checks in the ip2location_country_blocker_save_rules AJAX action, allowing any authenticated users, such as subscriber to call it and block arbitrary country, or block all of them at once, preventing users from accessing the frontend. Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/cbfa7211-ac1f-4cf2-bd79-ebce2fc4baa1 - https://plugins.tr
gram Container: References: - https://wpscan.com/vulnerability/cbfa7211-ac1f-4cf2-bd79-ebce2fc4baa1 - https://plugins.trac.wordpress.org/changeset/2652469