Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
.1.10, to include a crafted password reset link in the email, which would lead to an account takeover. Additional Analyst Notes: - CVE Program Container: References: - https://theplusaddons.com/changelog/ - https://wpscan.com/vulnerability/486b82d1-30d4-44d2-9542-f33e3f149e92
CVE ID: CVE-2021-24360 State: PUBLISHED Published: 2021-06-14T13:37:14 Last Updated: 2024-08-03T19:28:23.706Z Vendors: Unknown Products: Yes/No Chart Problem Types: CWE-89 Description: The Yes/No Chart WordPress plugin before 1.0.12 did not sanitise its sid shortcode parameter before using it in a SQL statement, allowing medium privilege users (contributor+) to perform Blind SQL Injection attacks Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/d9586453-cc5c-4d26-bb45-a6370c9427fe
CVE ID: CVE-2021-24361 State: PUBLISHED Published: 2021-06-21T19:18:14 Last Updated: 2024-08-03T19:28:23.436Z Vendors: AyeCode Ltd Products: Location Manager Problem Types: CWE-89 Description: In the Location Manager WordPress plugin before 2.1.0.10, the AJAX action gd_popular_location_list did not properly sanitise or validate some of its POST parameters, which are then used in a SQL statement, leading to unauthenticated SQL Injection issues. Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/5aff50fc-ac96-4076-a07c-bb145ae37025 - https://wpgeodirectory.com/downloads/location-manager/
CVE ID: CVE-2021-24362 State: PUBLISHED Published: 2021-08-16T10:48:16 Last Updated: 2024-08-03T19:28:23.722Z Vendors: Unknown Products: Photo Gallery by 10Web – Mobile-Friendly Image Gallery Problem Types: CWE-79 Description: The Photo Gallery by 10Web – Mobile-Friendly Image Gallery WordPress plugin before 1.5.75 did not ensure that uploaded SVG files added to a gallery do not contain malicious content. As a result, users allowed to add images to gallery can upload an SVG file containing JavaScript code, which will be executed when accessing the image directly (ie in the /wp-content/uploads/photo-gallery/ folder), leading to a Cross-Site Scripting (XSS) issue Additional Analyst Notes: - CV
/wp-content/uploads/photo-gallery/ folder), leading to a Cross-Site Scripting (XSS) issue Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/57823dcb-2149-47f7-aae2-d9f04dce851a
CVE ID: CVE-2021-24363 State: PUBLISHED Published: 2021-08-16T10:48:17 Last Updated: 2024-08-03T19:28:23.794Z Vendors: Unknown Products: Photo Gallery by 10Web – Mobile-Friendly Image Gallery Problem Types: CWE-22 Description: The Photo Gallery by 10Web – Mobile-Friendly Image Gallery WordPress plugin before 1.5.75 did not ensure that uploaded files are kept inside its uploads folder, allowing high privilege users to put images/SVG anywhere in the filesystem via a path traversal vector Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/1628935f-1d7d-4609-b7a9-e5526499c974
CVE ID: CVE-2021-24364 State: PUBLISHED Published: 2021-06-21T19:18:15 Last Updated: 2024-08-03T19:28:24.012Z Vendors: TieLabs Products: Jannah Problem Types: CWE-79 Description: The Jannah WordPress theme before 5.4.4 did not properly sanitize the options JSON parameter in its tie_get_user_weather AJAX action before outputting it back in the page, leading to a Reflected Cross-Site Scripting (XSS) vulnerability. Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/1d53fbe5-a879-42ca-a9d3-768a80018382
CVE ID: CVE-2021-24365 State: PUBLISHED Published: 2021-07-12T19:20:49 Last Updated: 2024-08-03T19:28:23.788Z Vendors: AdminColumns Products: Admin Columns, Admin Columns Pro Problem Types: CWE-79 Description: The Admin Columns WordPress plugin Free before 4.3.2 and Pro before 5.5.2 allowed to configure individual columns for tables. Each column had a type. The type "Custom Field" allowed to choose an arbitrary database column to display in the table. There was no escaping applied to the contents of "Custom Field" columns. Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/fdbeb137-b404-46c7-85fb-394a3bdac388 - https://www.syss.de/fileadmin/doku
References: - https://wpscan.com/vulnerability/fdbeb137-b404-46c7-85fb-394a3bdac388 - https://www.syss.de/fileadmin/dokumente/Publikationen/Advisories/SYSS-2021-032.txt
CVE ID: CVE-2021-24366 State: PUBLISHED Published: 2021-06-21T19:18:16.000Z Last Updated: 2025-05-05T16:54:02.160Z Vendors: Unknown Products: Admin Columns, Admin Columns Pro Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The Admin Columns WordPress plugin before 4.3 and Admin Columns Pro WordPress plugin before 5.5.1 do not sanitise and escape its Label settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup) Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/0542715
Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/05427156-4d5c-4aeb-add8-1c574fda5c28 - https://www.whitesourcesoftware.com/vulnerability-database/CVE-2021-24366 - https://github.com/codepress/admin-columns/commit/b45571ed21d574d13687213a5002e0c68e4442c7
CVE ID: CVE-2021-24367 State: PUBLISHED Published: 2021-06-21T19:18:17 Last Updated: 2024-08-03T19:28:23.785Z Vendors: Unknown Products: WP Config File Editor Problem Types: CWE-79 Description: The WP Config File Editor WordPress plugin through 1.7.1 was affected by an Authenticated Stored Cross-Site Scripting (XSS) vulnerability. Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/f35b7c8f-cfb6-42b6-8a3a-8c07cd1e9da0
CVE ID: CVE-2021-24368 State: PUBLISHED Published: 2021-06-20T12:31:32 Last Updated: 2024-08-03T19:28:23.844Z Vendors: ExpressTech Products: Quiz And Survey Master – Best Quiz, Exam and Survey Plugin for WordPress Problem Types: CWE-79 Description: The Quiz And Survey Master – Best Quiz, Exam and Survey Plugin WordPress plugin before 7.1.18 did not sanitise or escape its result_id parameter when displaying an existing quiz result page, leading to a reflected Cross-Site Scripting issue. This could allow for privilege escalation by inducing a logged in admin to open a malicious link Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/7f2fda5b-45a5-
us link Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/7f2fda5b-45a5-4fc6-968f-90bc9674c999
CVE ID: CVE-2021-24369 State: PUBLISHED Published: 2021-06-21T19:18:18 Last Updated: 2024-08-03T19:28:23.918Z Vendors: AyeCode Ltd Products: WordPress Payments Plugin | GetPaid Problem Types: CWE-79 Description: In the GetPaid WordPress plugin before 2.3.4, users with the contributor role and above can create a new Payment Form, however the Label and Help Text input fields were not getting sanitized properly. So it was possible to inject malicious content such as img tags, leading to a Stored Cross-Site Scripting issue which is triggered when the form will be edited, for example when an admin reviews it and could lead to privilege escalation. Additional Analyst Notes: - CVE Program Container
ample when an admin reviews it and could lead to privilege escalation. Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/1d1a731b-78f7-4d97-b40d-80f66700edae
CVE ID: CVE-2021-24370 State: PUBLISHED Published: 2021-06-21T00:00:00 Last Updated: 2024-08-03T19:28:23.807Z Vendors: Unknown Products: Fancy Product Designer Problem Types: CWE-434 Description: The Fancy Product Designer WordPress plugin before 4.6.9 allows unauthenticated attackers to upload arbitrary files, resulting in remote code execution. Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/82c52461-1fdc-41e4-9f51-f9dd84962b38 - https://www.wordfence.com/blog/2021/06/critical-0-day-in-fancy-product-designer-under-active-attack/ - https://lists.openwall.net/full-disclosure/2020/11/17/2 - https://seclists.org/fulldisclosure/2020/Nov/30 - htt
ttack/ - https://lists.openwall.net/full-disclosure/2020/11/17/2 - https://seclists.org/fulldisclosure/2020/Nov/30 - https://www.secpod.com/blog/critical-zero-day-flaw-actively-exploited-in-wordpress-fancy-product-designer-plugin/
CVE ID: CVE-2021-24371 State: PUBLISHED Published: 2021-08-02T10:31:53 Last Updated: 2024-08-03T19:28:23.827Z Vendors: Unknown Products: RSVPMaker Problem Types: CWE-918 Description: The Import feature of the RSVPMaker WordPress plugin before 8.7.3 (/wp-admin/tools.php?page=rsvpmaker_export_screen) takes an URL input and calls curl on it, without first validating it to ensure it's a remote one. As a result, a high privilege user could use that feature to scan the internal network via a SSRF attack. Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/63be225c-ebee-4cac-b43e-cf033ee7425d - https://codevigilant.com/disclosure/2021/wp-plugin-rsvpmake
can.com/vulnerability/63be225c-ebee-4cac-b43e-cf033ee7425d - https://codevigilant.com/disclosure/2021/wp-plugin-rsvpmaker/
CVE ID: CVE-2021-24372 State: PUBLISHED Published: 2021-06-21T19:18:19 Last Updated: 2024-08-03T19:28:23.783Z Vendors: Unknown Products: WP Hardening – Fix Your WordPress Security Problem Types: CWE-79 Description: The WP Hardening – Fix Your WordPress Security WordPress plugin before 1.2.2 did not sanitise or escape the $_SERVER['REQUEST_URI'] before outputting it in an attribute, leading to a reflected Cross-Site Scripting issue. Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/5340ae4e-95ba-4a69-beb1-3459cac17782
CVE ID: CVE-2021-24373 State: PUBLISHED Published: 2021-06-21T19:18:20 Last Updated: 2024-08-03T19:28:23.763Z Vendors: Unknown Products: WP Hardening – Fix Your WordPress Security Problem Types: CWE-79 Description: The WP Hardening – Fix Your WordPress Security WordPress plugin before 1.2.2 did not sanitise or escape the historyvalue GET parameter before outputting it in a Javascript block, leading to a reflected Cross-Site Scripting issue. Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/fcf17278-609f-4f75-8a87-9b4579dee1c8
CVE ID: CVE-2021-24374 State: PUBLISHED Published: 2021-06-21T19:18:21 Last Updated: 2024-08-03T19:28:23.899Z Vendors: Automattic Products: Jetpack – WP Security, Backup, Speed, & Growth Problem Types: CWE-639 Description: The Jetpack Carousel module of the JetPack WordPress plugin before 9.8 allows users to create a "carousel" type image gallery and allows users to comment on the images. A security vulnerability was found within the Jetpack Carousel module by nguyenhg_vcs that allowed the comments of non-published page/posts to be leaked. Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/08a8a51c-49d3-4bce-b7e0-e365af1d8f33 - https://jetpack.c
ogram Container: References: - https://wpscan.com/vulnerability/08a8a51c-49d3-4bce-b7e0-e365af1d8f33 - https://jetpack.com/2021/06/01/jetpack-9-8-engage-your-audience-with-wordpress-stories/
CVE ID: CVE-2021-24375 State: PUBLISHED Published: 2021-07-06T11:03:26 Last Updated: 2024-08-03T19:28:23.866Z Vendors: Stockware Products: Motor Problem Types: CWE-22 Description: Lack of authentication or validation in motor_load_more, motor_gallery_load_more, motor_quick_view and motor_project_quick_view AJAX handlers of the Motor WordPress theme before 3.1.0 allows an unauthenticated attacker access to arbitrary files in the server file system, and to execute arbitrary php scripts found on the server file system. We found no vulnerability for uploading files with this theme, so any scripts to be executed must already be on the server file system. Additional Analyst Notes: - CVE Program Co
eme, so any scripts to be executed must already be on the server file system. Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/d9518429-79d3-4b13-88ff-3722d05efa9f - https://jetpack.com/2021/06/09/motor-wordpress-theme-vulnerabilities/
CVE ID: CVE-2021-24376 State: PUBLISHED Published: 2021-06-21T19:18:22 Last Updated: 2024-08-03T19:28:23.812Z Vendors: Unknown Products: Autoptimize Problem Types: CWE-434 Description: The Autoptimize WordPress plugin before 2.7.8 attempts to delete malicious files (such as .php) form the uploaded archive via the "Import Settings" feature, after its extraction. However, the extracted folders are not checked and it is possible to upload a zip which contained a directory with PHP file in it and then it is not removed from the disk. It is a bypass of CVE-2020-24948 which allows sending a PHP file via the "Import Settings" functionality to achieve Remote Code Execution. Additional Analyst Notes:
s sending a PHP file via the "Import Settings" functionality to achieve Remote Code Execution. Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/93edcc23-894a-46c2-84d2-407dcb64ba1e
CVE ID: CVE-2021-24377 State: PUBLISHED Published: 2021-06-21T19:18:23 Last Updated: 2024-08-03T19:28:23.923Z Vendors: Unknown Products: Autoptimize Problem Types: CWE-362 Description: The Autoptimize WordPress plugin before 2.7.8 attempts to remove potential malicious files from the extracted archive uploaded via the 'Import Settings' feature, however this is not sufficient to protect against RCE as a race condition can be achieved in between the moment the file is extracted on the disk but not yet removed. It is a bypass of CVE-2020-24948. Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/85c0a564-2e56-413d-bc3a-1039343207e4
CVE ID: CVE-2021-24378 State: PUBLISHED Published: 2021-06-21T19:18:24 Last Updated: 2024-08-03T19:28:23.784Z Vendors: Unknown Products: Autoptimize Problem Types: CWE-79 Description: The Autoptimize WordPress plugin before 2.7.8 does not check for malicious files such as .html in the archive uploaded via the 'Import Settings' feature. As a result, it is possible for a high privilege user to upload a malicious file containing JavaScript code inside an archive which will execute when a victim visits index.html inside the plugin directory. Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/375bd694-1a30-41af-bbd4-8a8ee54f0dbf
CVE ID: CVE-2021-24379 State: PUBLISHED Published: 2021-06-21T19:18:25 Last Updated: 2024-08-03T19:28:23.786Z Vendors: Unknown Products: Comments Like Dislike Problem Types: CWE-863 Description: The Comments Like Dislike WordPress plugin before 1.1.4 allows users to like/dislike posted comments, however does not prevent them from replaying the AJAX request to add a like. This allows any user (even unauthenticated) to add unlimited like/dislike to any comment. The plugin appears to have some Restriction modes, such as Cookie Restriction, IP Restrictions, Logged In User Restriction, however, they do not prevent such attack as they only check client side Additional Analyst Notes: - CVE Program
iction, however, they do not prevent such attack as they only check client side Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/aae7a889-195c-45a3-bbe4-e6d4cd2d7fd9
CVE ID: CVE-2021-24380 State: PUBLISHED Published: 2021-08-16T10:48:18 Last Updated: 2024-08-03T19:28:23.765Z Vendors: Unknown Products: Shantz WordPress QOTD Problem Types: CWE-352 Description: The Shantz WordPress QOTD WordPress plugin through 1.2.2 is lacking any CSRF check when updating its settings, allowing attackers to make logged in administrators change them to arbitrary values. Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/1dd0f9a8-22ab-4ecc-a925-605822739000
CVE ID: CVE-2021-24381 State: PUBLISHED Published: 2021-10-25T13:20:32 Last Updated: 2024-08-03T19:28:23.777Z Vendors: Unknown Products: Ninja Forms Contact Form – The Drag and Drop Form Builder for WordPress Problem Types: CWE-79 Description: The Ninja Forms Contact Form WordPress plugin before 3.5.8.2 does not sanitise and escape the custom class name of the form field created, which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed. Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/e383fae6-e0da-4aba-bb62-adf51c01bf8d
CVE ID: CVE-2021-24382 State: PUBLISHED Published: 2021-06-14T13:37:14 Last Updated: 2024-08-03T19:28:23.902Z Vendors: Nextend Products: Smart Slider 3 Problem Types: CWE-79 Description: The Smart Slider 3 Free and pro WordPress plugins before 3.5.0.9 did not sanitise the Project Name before outputting it back in the page, leading to a Stored Cross-Site Scripting issue. By default, only administrator users could access the affected functionality, limiting the exploitability of the vulnerability. However, some WordPress admins may allow lesser privileged users to access the plugin's functionality, in which case, privilege escalation could be performed. Additional Analyst Notes: - CVE Program
plugin's functionality, in which case, privilege escalation could be performed. Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/7b32a282-e51f-4ee5-b59f-5ba10e62a54d - https://smartslider.helpscoutdocs.com/article/1746-changelog
CVE ID: CVE-2021-24383 State: PUBLISHED Published: 2021-06-21T19:18:26 Last Updated: 2024-08-03T19:28:23.794Z Vendors: WP Google Maps Products: WP Google Maps Problem Types: CWE-79 Description: The WP Google Maps WordPress plugin before 8.1.12 did not sanitise, validate of escape the Map Name when output in the Map List of the admin dashboard, leading to an authenticated Stored Cross-Site Scripting issue Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/1270588c-53fe-447e-b83c-1b877dc7a954 - http://packetstormsecurity.com/files/163261/WordPress-WP-Google-Maps-8.1.11-Cross-Site-Scripting.html
CVE ID: CVE-2021-24384 State: PUBLISHED Published: 2021-07-06T11:03:27 Last Updated: 2024-08-03T19:28:23.922Z Vendors: Unknown Products: JoomSport – for Sports: Team & League, Football, Hockey & more Problem Types: CWE-502 Description: The joomsport_md_load AJAX action of the JoomSport WordPress plugin before 5.1.8, registered for both unauthenticated and unauthenticated users, unserialised user input from the shattr POST parameter, leading to a PHP Object Injection issue. Even though the plugin does not have a suitable gadget chain to exploit this, other installed plugins could, which might lead to more severe issues such as RCE Additional Analyst Notes: - CVE Program Container: References:
could, which might lead to more severe issues such as RCE Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/fb6c407c-713c-4e83-92ce-4e5f791be696
CVE ID: CVE-2021-24385 State: PUBLISHED Published: 2021-07-12T19:20:50 Last Updated: 2024-08-03T19:28:23.789Z Vendors: Ninja Team Products: FileBird – WordPress Media Library Folders & File Manager Problem Types: CWE-89 Description: The Filebird Plugin 4.7.3 introduced a SQL injection vulnerability as it is making SQL queries without escaping user input data from a HTTP post request. This is a major vulnerability as the user input is not escaped and passed directly to the get_col function and it allows SQL injection. The Rest API endpoint which invokes this function also does not have any required permissions/authentication and can be accessed by an anonymous user. Additional Analyst Notes:
es not have any required permissions/authentication and can be accessed by an anonymous user. Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/754ac750-0262-4f65-b23e-d5523995fbfa - https://10up.com/blog/2021/security-vulnerability-filebird-wordpress-plugin/
CVE ID: CVE-2021-24386 State: PUBLISHED Published: 2021-07-06T11:03:28 Last Updated: 2024-08-03T19:28:23.913Z Vendors: KubiQ Products: WP SVG images Problem Types: CWE-79 Description: The WP SVG images WordPress plugin before 3.4 did not sanitise the SVG files uploaded, which could allow low privilege users such as author+ to upload a malicious SVG and then perform XSS attacks by inducing another user to access the file directly. In v3.4, the plugin restricted such upload to editors and admin, with an option to also allow author to do so. The description of the plugin has also been updated with a security warning as upload of such content is intended. Additional Analyst Notes: - CVE Program
lso been updated with a security warning as upload of such content is intended. Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/e9b48b19-14cc-41ad-a029-f7f9ae236e4e
CVE ID: CVE-2021-24387 State: PUBLISHED Published: 2021-07-06T11:03:29 Last Updated: 2024-08-03T19:28:23.787Z Vendors: Contempoinc Products: WP Pro Real Estate 7 Problem Types: CWE-79 Description: The WP Pro Real Estate 7 WordPress theme before 3.1.1 did not properly sanitise the ct_community parameter in its search listing page before outputting it back in it, leading to a reflected Cross-Site Scripting which can be triggered in both unauthenticated or authenticated user context Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/27264f30-71d5-4d2b-8f36-4009a2be6745 - https://contempothemes.com/wp-real-estate-7/changelog/
CVE ID: CVE-2021-24388 State: PUBLISHED Published: 2021-07-06T11:03:29 Last Updated: 2024-08-03T19:28:23.894Z Vendors: E4J s.r.l. Products: VikRentCar Car Rental Management System Problem Types: CWE-79, CWE-352 Description: In the VikRentCar Car Rental Management System WordPress plugin before 1.1.7, there is a custom filed option by which we can manage all the fields that the users will have to fill in before saving the order. However, the field name is not sanitised or escaped before being output back in the page, leading to a stored Cross-Site Scripting issue. There is also no CSRF check done before saving the setting, allowing attackers to make a logged in admin set arbitrary Custom Fiel
lso no CSRF check done before saving the setting, allowing attackers to make a logged in admin set arbitrary Custom Fields, including one with XSS payload in it. Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/e3f6576f-08cb-4278-8c79-3ef4d0b85cd9
CVE ID: CVE-2021-24389 State: PUBLISHED Published: 2021-07-06T11:03:30 Last Updated: 2024-08-03T19:28:23.807Z Vendors: Chimpstudio Products: WP Foodbakery, FoodBakery Problem Types: CWE-79 Description: The WP Foodbakery WordPress plugin before 2.2, used in the FoodBakery WordPress theme before 2.2 did not properly sanitize the foodbakery_radius parameter before outputting it back in the response, leading to an unauthenticated Reflected Cross-Site Scripting (XSS) vulnerability. Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/23b8b8c4-cded-4887-a021-5f3ea610213b
CVE ID: CVE-2021-24390 State: PUBLISHED Published: 2021-09-06T11:09:19 Last Updated: 2024-08-03T19:28:23.974Z Vendors: Unknown Products: WordPress支付宝Alipay|财付通Tenpay|贝宝PayPal集成插件 Problem Types: CWE-89 Description: A proid GET parameter of the WordPress支付宝Alipay|财付通Tenpay|贝宝PayPal集成插件 WordPress plugin through 3.7.2 is not sanitised, properly escaped or validated before inserting to a SQL statement not delimited by quotes, leading to SQL injection. Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/92b0abec-082f-4545-9636-1b2f4dac66fe - https://codevigilant.com/disclosure/2021/wp-plugin-alipay/