Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2021-25022 State: PUBLISHED Published: 2022-01-03T12:49:15.000Z Last Updated: 2025-05-22T18:40:18.824Z Vendors: Unknown Products: UpdraftPlus WordPress Backup Plugin Problem Types: CWE-79 Description: The UpdraftPlus WordPress Backup Plugin WordPress plugin before 1.16.66 does not sanitise and escape the backup_timestamp and job_id parameter before outputting then back in admin pages, leading to Reflected Cross-Site Scripting issues Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/1801c7ae-2b5c-493f-969d-4bb19a9feb15 - https://plugins.trac.wordpress.org/changeset/2635585/updraftplus - https://plugins.trac.w
-2b5c-493f-969d-4bb19a9feb15 - https://plugins.trac.wordpress.org/changeset/2635585/updraftplus - https://plugins.trac.wordpress.org/changeset/2637112/updraftplus
CVE ID: CVE-2021-25023 State: PUBLISHED Published: 2022-01-03T12:49:15 Last Updated: 2024-08-03T19:49:14.527Z Vendors: Unknown Products: Speed Booster Pack ⚡ PageSpeed Optimization Suite Problem Types: CWE-89 Description: The Speed Booster Pack ⚡ PageSpeed Optimization Suite WordPress plugin before 4.3.3.1 does not escape the sbp_convert_table_name parameter before using it in a SQL statement to convert the related table, leading to an SQL injection Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/4a27d374-f690-4a8a-987a-9e0f56bbe143
CVE ID: CVE-2021-25024 State: PUBLISHED Published: 2022-01-17T13:00:31 Last Updated: 2024-08-03T19:49:14.665Z Vendors: Unknown Products: EventCalendar Problem Types: CWE-79 Description: The EventCalendar WordPress plugin before 1.1.51 does not escape some user input before outputting it back in attributes, leading to Reflected Cross-SIte Scripting issues Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/08864b76-d898-4dfe-970d-d7cc1b1115a7
CVE ID: CVE-2021-25025 State: PUBLISHED Published: 2022-01-17T00:00:00 Last Updated: 2024-08-03T19:49:14.534Z Vendors: Unknown Products: EventCalendar Problem Types: CWE-352, CWE-862 Description: The EventCalendar WordPress plugin before 1.1.51 does not have proper authorisation and CSRF checks in the add_calendar_event AJAX actions, allowing users with a role as low as subscriber to create events Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/24fb4eb4-9fe1-4433-8844-8904eaf13c0e
CVE ID: CVE-2021-25026 State: PUBLISHED Published: 2022-03-14T14:41:16 Last Updated: 2024-08-03T19:49:14.659Z Vendors: Unknown Products: Patreon WordPress Problem Types: CWE-79 Description: The Patreon WordPress plugin before 1.8.2 does not sanitise and escape the field "Custom Patreon Page name", which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/02756dd3-832a-4846-b9e1-a34f148b5cfe - https://plugins.trac.wordpress.org/changeset/2682069
CVE ID: CVE-2021-25027 State: PUBLISHED Published: 2022-01-03T12:49:16 Last Updated: 2024-08-03T19:49:14.593Z Vendors: Unknown Products: PowerPack Addons for Elementor Problem Types: CWE-79 Description: The PowerPack Addons for Elementor WordPress plugin before 2.6.2 does not escape the tab parameter before outputting it back in an attribute in the admin dashboard, leading to a Reflected Cross-Site Scripting issue Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/48612c44-151d-4438-b91c-c27e96174270 - https://plugins.trac.wordpress.org/changeset/2638073
CVE ID: CVE-2021-25028 State: PUBLISHED Published: 2022-01-24T08:01:12 Last Updated: 2024-08-03T19:49:14.594Z Vendors: Unknown Products: Event Tickets Problem Types: CWE-601 Description: The Event Tickets WordPress plugin before 5.2.2 does not validate the tribe_tickets_redirect_to parameter before redirecting the user to the given value, leading to an arbitrary redirect issue Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/80b0682e-2c3b-441b-9628-6462368e5fc7
CVE ID: CVE-2021-25029 State: PUBLISHED Published: 2022-02-07T15:47:16 Last Updated: 2024-08-03T19:49:14.629Z Vendors: Unknown Products: CLUEVO LMS, E-Learning Platform Problem Types: CWE-79 Description: The CLUEVO LMS, E-Learning Platform WordPress plugin before 1.8.1 does not sanitise and escape Course's module, which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/723d0d07-c48b-4fe3-9fb2-7dae3c7d3cfb
CVE ID: CVE-2021-25030 State: PUBLISHED Published: 2022-01-03T12:49:17 Last Updated: 2024-08-03T19:49:14.585Z Vendors: Unknown Products: Events Made Easy Problem Types: CWE-89 Description: The Events Made Easy WordPress plugin before 2.2.36 does not sanitise and escape the search_text parameter before using it in a SQL statement via the eme_searchmail AJAX action, available to any authenticated users. As a result, users with a role as low as subscriber can call it and perform SQL injection attacks Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/bc7058b1-ca93-4c45-9ced-7848c7ae4150
CVE ID: CVE-2021-25031 State: PUBLISHED Published: 2022-01-24T08:01:14 Last Updated: 2024-08-03T19:49:14.592Z Vendors: Unknown Products: Image Hover Effects Ultimate (Image Gallery, Effects, Lightbox, Comparison or Magnifier) Problem Types: CWE-79 Description: The Image Hover Effects Ultimate (Image Gallery, Effects, Lightbox, Comparison or Magnifier) WordPress plugin before 9.7.1 does not escape the effects parameter before outputting it back in an attribute in an admin page, leading to a Reflected Cross-Site Scripting Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/1fbcf5ec-498e-4d40-8577-84b8c7ac3201 - https://plugins.trac.wordpress.org/ch
erences: - https://wpscan.com/vulnerability/1fbcf5ec-498e-4d40-8577-84b8c7ac3201 - https://plugins.trac.wordpress.org/changeset/2648086
CVE ID: CVE-2021-25032 State: PUBLISHED Published: 2022-01-10T00:00:00 Last Updated: 2024-08-03T19:49:14.582Z Vendors: Unknown Products: PublishPress Capabilities – User Role Access, Editor Permissions, Admin Menus, PublishPress Capabilities Pro Problem Types: CWE-352, CWE-862 Description: The PublishPress Capabilities WordPress plugin before 2.3.1, PublishPress Capabilities Pro WordPress plugin before 2.3.1 does not have authorisation and CSRF checks when updating the plugin's settings via the init hook, and does not ensure that the options to be updated belong to the plugin. As a result, unauthenticated attackers could update arbitrary blog options, such as the default role and make any ne
in. As a result, unauthenticated attackers could update arbitrary blog options, such as the default role and make any new registered user with an administrator role. Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/2f0f1a32-0c7a-48e6-8617-e0b2dcf62727 - https://plugins.trac.wordpress.org/changeset/2640161
CVE ID: CVE-2021-25033 State: PUBLISHED Published: 2022-02-14T09:20:45 Last Updated: 2024-08-03T19:49:14.591Z Vendors: Unknown Products: WordPress Newsletter Plugin – Noptin Problem Types: CWE-601 Description: The WordPress Newsletter Plugin WordPress plugin before 1.6.5 does not validate the to parameter before redirecting the user to its given value, leading to an open redirect issue Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/c2d2384c-41b9-4aaf-b918-c1cfda58af5c - https://plugins.trac.wordpress.org/changeset/2639592
CVE ID: CVE-2021-25034 State: PUBLISHED Published: 2022-02-28T09:06:32 Last Updated: 2024-08-03T19:49:14.550Z Vendors: Unknown Products: WP User – Custom Registration Forms, Login and User Profile Problem Types: CWE-79 Description: The WP User WordPress plugin before 7.0 does not sanitise and escape some parameters in pages where the [wp_user] shortcode is used, leading to Reflected Cross-Site Scripting issues Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/c4e50dd2-450f-413d-b15f-ece413e42157
CVE ID: CVE-2021-25035 State: PUBLISHED Published: 2022-01-24T08:01:15 Last Updated: 2024-08-03T19:49:14.533Z Vendors: Unknown Products: Backup and Staging by WP Time Capsule Problem Types: CWE-79 Description: The Backup and Staging by WP Time Capsule WordPress plugin before 1.22.7 does not sanitise and escape the error parameter before outputting it back in an admin page, leading to a Reflected Cross-Site Scripting Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/f426360e-5ba0-4d6b-bfd4-61bc54be3469 - https://plugins.trac.wordpress.org/changeset/2641264
CVE ID: CVE-2021-25036 State: PUBLISHED Published: 2022-01-17T13:00:34 Last Updated: 2024-08-03T19:49:14.632Z Vendors: Unknown Products: All in One SEO – Best WordPress SEO Plugin – Easily Improve SEO Rankings & Increase Traffic Problem Types: CWE-287 Description: The All in One SEO WordPress plugin before 4.1.5.3 is affected by a Privilege Escalation issue, which was discovered during an internal audit by the Jetpack Scan team, and may grant bad actors access to protected REST API endpoints they shouldn’t have access to. This could ultimately enable users with low-privileged accounts, like subscribers, to perform remote code execution on affected sites. Additional Analyst Notes: - CVE Progr
ed accounts, like subscribers, to perform remote code execution on affected sites. Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/6de4a7de-6b71-4349-8e52-04c89c5e6d6c - https://jetpack.com/2021/12/14/severe-vulnerabilities-fixed-in-all-in-one-seo-plugin-version-4-1-5-3/ - https://plugins.trac.wordpress.org/changeset/2640944/all-in-one-seo-pack/trunk/app/Common/Api/Api.php
CVE ID: CVE-2021-25037 State: PUBLISHED Published: 2022-01-17T13:00:36 Last Updated: 2024-08-03T19:49:14.558Z Vendors: Unknown Products: All in One SEO – Best WordPress SEO Plugin – Easily Improve SEO Rankings & Increase Traffic Problem Types: CWE-89 Description: The All in One SEO WordPress plugin before 4.1.5.3 is affected by an authenticated SQL injection issue, which was discovered during an internal audit by the Jetpack Scan team, and could grant attackers access to privileged information from the affected site’s database (e.g., usernames and hashed passwords). Additional Analyst Notes: - CVE Program Container: References: - https://jetpack.com/2021/12/14/severe-vulnerabilities-fixed-in
nal Analyst Notes: - CVE Program Container: References: - https://jetpack.com/2021/12/14/severe-vulnerabilities-fixed-in-all-in-one-seo-plugin-version-4-1-5-3/ - https://wpscan.com/vulnerability/4cd2a57b-3e1a-4acf-aecb-201ed9f4ee6d - https://plugins.trac.wordpress.org/changeset/2640944/all-in-one-seo-pack/trunk/app/Common/Api/PostsTerms.php
CVE ID: CVE-2021-25038 State: PUBLISHED Published: 2022-03-07T08:16:15 Last Updated: 2024-08-03T19:49:14.542Z Vendors: Unknown Products: WordPress Multisite User Sync/Unsync Problem Types: CWE-79 Description: The WordPress Multisite User Sync/Unsync WordPress plugin before 2.1.2 does not sanitise and escape the wmus_source_blog and wmus_record_per_page parameters before outputting them back in attributes, leading to Reflected Cross-Site Scripting issues Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/72ccdcb9-3d24-41d7-b9fa-c8bd73d30aa6
CVE ID: CVE-2021-25039 State: PUBLISHED Published: 2022-03-07T08:16:16 Last Updated: 2024-08-03T19:49:14.586Z Vendors: Unknown Products: WordPress Multisite Content Copier/Updater Problem Types: CWE-79 Description: The WordPress Multisite Content Copier/Updater WordPress plugin before 2.1.0 does not sanitise and escape the wmcc_content_type, wmcc_source_blog and wmcc_record_per_page parameters before outputting them back in attributes, leading to Reflected Cross-Site Scripting issues Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/c92eb2bf-0a5d-40b9-b0be-1820e7b9bebb
CVE ID: CVE-2021-25040 State: PUBLISHED Published: 2022-01-03T12:49:18 Last Updated: 2024-08-03T19:49:14.581Z Vendors: Unknown Products: Booking Calendar Problem Types: CWE-79 Description: The Booking Calendar WordPress plugin before 8.9.2 does not sanitise and escape the booking_type parameter before outputting it back in an admin page, leading to a Reflected Cross-Site Scripting Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/3ed821a6-c3e2-4964-86f8-d14c4a54708a
CVE ID: CVE-2021-25041 State: PUBLISHED Published: 2021-12-06T15:55:40 Last Updated: 2024-08-03T19:49:14.594Z Vendors: Unknown Products: Photo Gallery by 10Web – Mobile-Friendly Image Gallery Problem Types: CWE-79 Description: The Photo Gallery by 10Web WordPress plugin before 1.5.68 is vulnerable to Reflected Cross-Site Scripting (XSS) issues via the bwg_album_breadcrumb_0 and shortcode_id GET parameters passed to the bwg_frontend_data AJAX action Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/32aee3ea-e0af-44da-a16c-102c83eaed8f - https://plugins.trac.wordpress.org/changeset/2467205
CVE ID: CVE-2021-25042 State: PUBLISHED Published: 2022-02-28T09:06:33 Last Updated: 2024-08-03T19:49:14.590Z Vendors: Unknown Products: WP Visitor Statistics (Real Time Traffic) Problem Types: CWE-862 Description: The WP Visitor Statistics (Real Time Traffic) WordPress plugin before 5.5 does not have authorisation and CSRF checks in the updateIpAddress AJAX action, allowing any authenticated user to call it, or make a logged in user do it via a CSRF attack and add an arbitrary IP address to exclude. Furthermore, due to the lack of validation, sanitisation and escaping, users could set a malicious value and perform Cross-Site Scripting attacks against logged in admin Additional Analyst Notes
rs could set a malicious value and perform Cross-Site Scripting attacks against logged in admin Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/05b9e478-2d3b-4460-88c1-7f81d3a68ac4
CVE ID: CVE-2021-25043 State: PUBLISHED Published: 2022-01-10T15:30:33 Last Updated: 2024-08-03T19:49:14.600Z Vendors: Unknown Products: WOOCS – Currency Switcher for WooCommerce. Professional and Free multi currency plugin – Pay in selected currency Problem Types: CWE-79 Description: The WOOCS WordPress plugin before 1.3.7.3 does not sanitise and escape the custom_prices parameter before outputting it back in the response, leading to a Reflected Cross-Site Scripting issue Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/8601bd21-becf-4809-8c11-d053d1121eae - https://plugins.trac.wordpress.org/changeset/2640621/woocommerce-currency-switcher
CVE ID: CVE-2021-25044 State: PUBLISHED Published: 2022-10-10T00:00:00 Last Updated: 2024-08-03T19:49:14.532Z Vendors: Unknown Products: Cryptocurrency Pricing list and Ticker Problem Types: CWE-79 Description: The Cryptocurrency Pricing list and Ticker WordPress plugin through 1.5 does not sanitise and escape the ccpw_setpage parameter before outputting it back in pages where its shortcode is embed, leading to a Reflected Cross-Site Scripting issue Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/dc1507c1-8894-4ab6-b25f-c5e26a425b03
CVE ID: CVE-2021-25045 State: PUBLISHED Published: 2022-01-24T08:01:16 Last Updated: 2024-08-03T19:49:14.553Z Vendors: Unknown Products: Asgaros Forum Problem Types: CWE-89 Description: The Asgaros Forum WordPress plugin before 1.15.15 does not validate or escape the forum_id parameter before using it in a SQL statement when editing a forum, leading to an SQL injection issue Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/c60a3d40-449c-4c84-8d13-68c04267c1d7 - https://plugins.trac.wordpress.org/changeset/2642215
CVE ID: CVE-2021-25046 State: PUBLISHED Published: 2022-01-17T13:00:37 Last Updated: 2024-08-03T19:49:14.633Z Vendors: Unknown Products: Modern Events Calendar Lite Problem Types: CWE-79 Description: The Modern Events Calendar Lite WordPress plugin before 6.2.0 alloed any logged-in user, even a subscriber user, may add a category whose parameters are incorrectly escaped in the admin panel, leading to stored XSS. Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/19c2f456-a41e-4755-912d-13683719bae6
CVE ID: CVE-2021-25047 State: PUBLISHED Published: 2022-01-10T15:30:34 Last Updated: 2024-08-03T19:49:14.583Z Vendors: Unknown Products: 10Web Social Photo Feed Problem Types: CWE-79 Description: The 10Web Social Photo Feed WordPress plugin before 1.4.29 was affected by a reflected Cross-Site Scripting (XSS) vulnerability in the wdi_apply_changes admin page, allowing an attacker to perform such attack against any logged in users Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/d33241cc-17b6-491a-b836-dd9368652316
CVE ID: CVE-2021-25048 State: PUBLISHED Published: 2022-04-04T15:35:37 Last Updated: 2024-08-03T19:49:14.560Z Vendors: Unknown Products: Page Builder: KingComposer – Free Drag and Drop page builder by King-Theme Problem Types: CWE-79 Description: The KingComposer WordPress plugin through 2.9.6 does not have authorisation, CSRF and sanitisation/escaping when creating profile, allowing any authenticated users to create arbitrary ones, with Cross-Site Scripting payloads in them Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/5687e5db-d987-416d-a7f4-036cce4d56cb
CVE ID: CVE-2021-25049 State: PUBLISHED Published: 2022-01-24T08:01:18 Last Updated: 2024-08-03T19:49:14.626Z Vendors: Unknown Products: Mobile Events Manager Problem Types: CWE-79 Description: The Mobile Events Manager WordPress plugin before 1.4.4 does not sanitise and escape various of its settings, allowing high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/227cbf50-59da-4f4c-85da-1959a108ae7e - https://plugins.trac.wordpress.org/changeset/2647987
CVE ID: CVE-2021-25050 State: PUBLISHED Published: 2022-02-14T09:20:46 Last Updated: 2024-08-03T19:49:14.629Z Vendors: Unknown Products: Remove Footer Credit Problem Types: CWE-79 Description: The Remove Footer Credit WordPress plugin before 1.0.11 does properly sanitise its settings, allowing high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html is disallowed. Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/25a28adb-794f-4bdb-89e8-060296b45b38 - https://plugins.trac.wordpress.org/changeset/2655918
CVE ID: CVE-2021-25051 State: PUBLISHED Published: 2022-01-10T15:30:35 Last Updated: 2024-08-03T19:49:14.554Z Vendors: Unknown Products: Modal Window – create popup modal window Problem Types: CWE-352 Description: The Modal Window WordPress plugin before 5.2.2 within the wow-company admin menu page allows to include() arbitrary file with PHP extension (as well as with data:// or http:// protocols), thus leading to CSRF RCE. Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/566ff8dc-f820-412b-b2d3-fa789bce528e - https://plugins.trac.wordpress.org/changeset/2641645/modal-window
CVE ID: CVE-2021-25052 State: PUBLISHED Published: 2022-01-10T15:30:36 Last Updated: 2024-08-03T19:49:14.549Z Vendors: Unknown Products: Button Generator – easily Button Builder Problem Types: CWE-352 Description: The Button Generator WordPress plugin before 2.3.3 within the wow-company admin menu page allows to include() arbitrary file with PHP extension (as well as with data:// or http:// protocols), thus leading to CSRF RCE. Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/a01844a0-0c43-4d96-b738-57fe5bfbd67a - https://plugins.trac.wordpress.org/changeset/2641639/button-generation
CVE ID: CVE-2021-25053 State: PUBLISHED Published: 2022-01-10T15:30:36 Last Updated: 2024-08-03T19:49:14.585Z Vendors: Unknown Products: WP Coder – add custom html, css and js code Problem Types: CWE-352 Description: The WP Coder WordPress plugin before 2.5.2 within the wow-company admin menu page allows to include() arbitrary file with PHP extension (as well as with data:// or http:// protocols), thus leading to CSRF RCE. Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/a5448599-64de-43b0-b04d-c6492366eab1 - https://plugins.trac.wordpress.org/changeset/2641650/wp-coder
CVE ID: CVE-2021-25054 State: PUBLISHED Published: 2022-01-10T15:30:37 Last Updated: 2024-08-03T19:49:14.539Z Vendors: Unknown Products: WPcalc – create any online calculators Problem Types: CWE-89 Description: The WPcalc WordPress plugin through 2.1 does not sanitize user input into the 'did' parameter and uses it in a SQL statement, leading to an authenticated SQL Injection vulnerability. Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/200969eb-e2a4-4200-82d7-0c313de089af
CVE ID: CVE-2021-25055 State: PUBLISHED Published: 2022-02-21T10:45:42 Last Updated: 2024-08-03T19:49:14.591Z Vendors: Unknown Products: FeedWordPress Problem Types: CWE-79 Description: The FeedWordPress plugin before 2022.0123 is affected by a Reflected Cross-Site Scripting (XSS) within the "visibility" parameter. Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/7ed050a4-27eb-4ecb-9182-1d8fa1e71571 - https://plugins.trac.wordpress.org/changeset/2662665
CVE ID: CVE-2021-25056 State: PUBLISHED Published: 2022-07-04T13:05:21 Last Updated: 2024-08-03T19:49:14.590Z Vendors: Unknown Products: Ninja Forms Contact Form – The Drag and Drop Form Builder for WordPress Problem Types: CWE-79 Description: The Ninja Forms Contact Form WordPress plugin before 3.6.10 does not sanitise and escape field labels, allowing high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed. Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/795acab2-f621-4662-834b-ebb6205ef7de
CVE ID: CVE-2021-25057 State: PUBLISHED Published: 2022-02-21T10:45:44 Last Updated: 2024-08-03T19:49:14.631Z Vendors: Unknown Products: Translation Exchange – Translate Your WordPress Site In Minutes! Problem Types: CWE-79 Description: The Translation Exchange WordPress plugin through 1.0.14 was vulnerable to Authenticated Stored Cross-Site Scripting (XSS) within the Project Key text field found in the plugin's settings. Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/c0dd3ef1-579d-43a4-801a-660c41495d58
CVE ID: CVE-2021-25058 State: PUBLISHED Published: 2022-02-21T10:45:45 Last Updated: 2024-08-03T19:49:14.590Z Vendors: Unknown Products: The Buffer Button Problem Types: CWE-79 Description: The Buffer Button WordPress plugin through 1.0 was vulnerable to Authenticated Stored Cross Site Scripting (XSS) within the Twitter username to mention text field. Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/fd5271ef-1da5-4d09-888e-f1fd71820cde