Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2021-38336 State: PUBLISHED Published: 2021-09-10T13:34:12.235Z Last Updated: 2025-05-02T19:47:39.221Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: Edit Comments XT Products: Edit Comments XT Problem Types: CWE-79 Description: The Edit Comments XT WordPress plugin is vulnerable to Reflected Cross-Site Scripting due to a reflected $_SERVER["PHP_SELF"] value in the ~/edit-comments-xt.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 1.0. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/vulnerability-advisories/#CVE-2021-38336 - https
ainer: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/vulnerability-advisories/#CVE-2021-38336 - https://plugins.trac.wordpress.org/browser/edit-comments-xt/tags/1.0/edit-comments-xt.php#L249
CVE ID: CVE-2021-38337 State: PUBLISHED Published: 2021-09-10T13:32:28.038Z Last Updated: 2025-05-02T19:48:43.630Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: RSVPMaker Excel Products: RSVPMaker Excel Problem Types: CWE-79 Description: The RSVPMaker Excel WordPress plugin is vulnerable to Reflected Cross-Site Scripting due to a reflected $_SERVER["PHP_SELF"] value in the ~/phpexcel/PHPExcel/Shared/JAMA/docs/download.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 1.1. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/vulnerability-advisories
otes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/vulnerability-advisories/#CVE-2021-38337 - https://plugins.trac.wordpress.org/browser/rsvpmaker-excel/tags/1.2/phpexcel/PHPExcel/Shared/JAMA/docs/download.php#L61
CVE ID: CVE-2021-38338 State: PUBLISHED Published: 2021-09-10T13:33:30.834Z Last Updated: 2025-05-02T20:13:08.311Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: Border Loading Bar Products: Border Loading Bar Problem Types: CWE-79 Description: The Border Loading Bar WordPress plugin is vulnerable to Reflected Cross-Site Scripting via the `f` and `t` parameter found in the ~/titan-framework/iframe-googlefont-preview.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 1.0.1. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/vulnerability-advisories/
tes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/vulnerability-advisories/#CVE-2021-38338 - https://plugins.trac.wordpress.org/browser/border-loading-bar/trunk/titan-framework/iframe-googlefont-preview.php#L39
CVE ID: CVE-2021-38339 State: PUBLISHED Published: 2021-09-10T13:34:31.309Z Last Updated: 2025-05-02T19:46:00.526Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: Simple Matted Thumbnails Products: Simple Matted Thumbnails Problem Types: CWE-79 Description: The Simple Matted Thumbnails WordPress plugin is vulnerable to Reflected Cross-Site Scripting due to a reflected $_SERVER["PHP_SELF"] value in the ~/simple-matted-thumbnail.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 1.01. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/vulnerability-ad
nalyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/vulnerability-advisories/#CVE-2021-38339 - https://plugins.trac.wordpress.org/browser/simple-matted-thumbnails/tags/1.01/simple-matted-thumbnail.php#L122
CVE ID: CVE-2021-38340 State: PUBLISHED Published: 2021-09-10T13:33:02.073Z Last Updated: 2025-05-02T19:51:27.692Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: Wordpress Simple Shop Products: Wordpress Simple Shop Problem Types: CWE-79 Description: The Wordpress Simple Shop WordPress plugin is vulnerable to Reflected Cross-Site Scripting via the update_row parameter found in the ~/includes/add_product.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 1.2. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/vulnerability-advisories/#CVE-2021-38340
ram Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/vulnerability-advisories/#CVE-2021-38340 - https://plugins.trac.wordpress.org/browser/webful-simple-grocery-shop/trunk/includes/add_product.php#L80
CVE ID: CVE-2021-38341 State: PUBLISHED Published: 2021-09-10T13:33:07.295Z Last Updated: 2025-05-02T19:50:21.274Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: WooCommerce Payment Gateway Per Category Products: WooCommerce Payment Gateway Per Category Problem Types: CWE-79 Description: The WooCommerce Payment Gateway Per Category WordPress plugin is vulnerable to Reflected Cross-Site Scripting due to a reflected $_SERVER["PHP_SELF"] value in the ~/includes/plugin_settings.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 2.0.10. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: Refer
n versions up to and including 2.0.10. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/vulnerability-advisories/#CVE-2021-38341 - https://plugins.trac.wordpress.org/browser/wc-payment-gateway-per-category/tags/2.0.10/includes/plugin_settings.php#L31
CVE ID: CVE-2021-38342 State: PUBLISHED Published: 2021-08-30T18:05:17.172902Z Last Updated: 2024-09-17T00:56:54.133Z Severity: HIGH (CVSS 8.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H) Vendors: Kyle Phillips Products: Nested Pages Problem Types: CWE-352 Description: The Nested Pages WordPress plugin <= 3.1.15 was vulnerable to Cross-Site Request Forgery via the `npBulkAction`s and `npBulkEdit` `admin_post` actions, which allowed attackers to trash or permanently purge arbitrary posts as well as changing their status, reassigning their ownership, and editing other metadata. Additional Analyst Notes: - CVE Program Container: References: - https://www.wordfence.com/blog/2021/08/nested-pages
ta. Additional Analyst Notes: - CVE Program Container: References: - https://www.wordfence.com/blog/2021/08/nested-pages-pat%E2%80%A6on-vulnerability/
CVE ID: CVE-2021-38343 State: PUBLISHED Published: 2021-08-30T18:05:15.116301Z Last Updated: 2024-09-17T03:53:12.499Z Severity: MEDIUM (CVSS 4.7 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:N) Vendors: Kyle Phillips Products: Nested Pages Problem Types: CWE-601 Description: The Nested Pages WordPress plugin <= 3.1.15 was vulnerable to an Open Redirect via the `page` POST parameter in the `npBulkActions`, `npBulkEdit`, `npListingSort`, and `npCategoryFilter` `admin_post` actions. Additional Analyst Notes: - CVE Program Container: References: - https://www.wordfence.com/blog/2021/08/nested-pages-pat%E2%80%A6on-vulnerability/
CVE ID: CVE-2021-38344 State: PUBLISHED Published: 2021-10-14T15:56:46.370Z Last Updated: 2025-02-14T18:12:02.020Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: Brizy.io Products: Brizy - Page Builder Problem Types: CWE-79 Description: The Brizy Page Builder plugin <= 2.3.11 for WordPress was vulnerable to stored XSS by lower-privileged users such as a subscribers. It was possible to add malicious JavaScript to a page by modifying the request sent to update the page via the brizy_update_item AJAX action and adding JavaScript to the data parameter, which would be executed in the session of any visitor viewing or previewing the post or page. Additional Analy
arameter, which would be executed in the session of any visitor viewing or previewing the post or page. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/blog/2021/10/multiple-vulnerabilities-in-brizy-page-builder-plugin-allow-site-takeover/
CVE ID: CVE-2021-38345 State: PUBLISHED Published: 2021-10-14T15:56:51.848Z Last Updated: 2025-02-14T18:11:40.173Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L) Vendors: Brizy.io Products: Brizy - Page Builder Problem Types: CWE-79 Description: The Brizy Page Builder plugin <= 2.3.11 for WordPress used an incorrect authorization check that allowed any logged-in user accessing any endpoint in the wp-admin directory to modify the content of any existing post or page created with the Brizy editor. An identical issue was found by another researcher in Brizy <= 1.0.125 and fixed in version 1.0.126, but the vulnerability was reintroduced in version 1.0.127. Additional Anal
rizy <= 1.0.125 and fixed in version 1.0.126, but the vulnerability was reintroduced in version 1.0.127. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/blog/2021/10/multiple-vulnerabilities-in-brizy-page-builder-plugin-allow-site-takeover/
CVE ID: CVE-2021-38346 State: PUBLISHED Published: 2021-10-14T15:56:57.210Z Last Updated: 2025-02-14T18:11:15.472Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: Brizy.io Products: Brizy - Page Builder Problem Types: CWE-79 Description: The Brizy Page Builder plugin <= 2.3.11 for WordPress allowed authenticated users to upload executable files to a location of their choice using the brizy_create_block_screenshot AJAX action. The file would be named using the id parameter, which could be prepended with "../" to perform directory traversal, and the file contents were populated via the ibsf parameter, which would be base64-decoded and written to the file. While
d the file contents were populated via the ibsf parameter, which would be base64-decoded and written to the file. While the plugin added a .jpg extension to all uploaded filenames, a double extension attack was still possible, e.g. a file named shell.php would be saved as shell.php.jpg, and would be executable on a number of common configurations. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/blog/2021/10/multiple-vulnerabilities-in-brizy-page-builder-plugin-allow-site-takeover/
CVE ID: CVE-2021-38347 State: PUBLISHED Published: 2021-09-10T13:34:24.436Z Last Updated: 2025-05-02T19:46:21.170Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: Custom Website Data Products: Custom Website Data Problem Types: CWE-79 Description: The Custom Website Data WordPress plugin is vulnerable to Reflected Cross-Site Scripting via the id parameter found in the ~/views/edit.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 2.2. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/vulnerability-advisories/#CVE-2021-38347 - https://plugins.trac.
P Vulnrichment: References: - https://www.wordfence.com/vulnerability-advisories/#CVE-2021-38347 - https://plugins.trac.wordpress.org/browser/simple-custom-website-data/tags/2.2/views/edit.php#L30
CVE ID: CVE-2021-38348 State: PUBLISHED Published: 2021-09-10T13:32:38.774Z Last Updated: 2025-05-02T19:53:39.565Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: Advance Search Products: Advance Search Problem Types: CWE-79 Description: The Advance Search WordPress plugin is vulnerable to Reflected Cross-Site Scripting via the wpas_id parameter found in the ~/inc/admin/views/html-advance-search-admin-options.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 1.1.2. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/vulnerability-advisories/#CVE-202
VE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/vulnerability-advisories/#CVE-2021-38348 - https://plugins.trac.wordpress.org/browser/advance-search/trunk/inc/admin/views/html-advance-search-admin-options.php#L88
CVE ID: CVE-2021-38349 State: PUBLISHED Published: 2021-09-10T13:32:55.483Z Last Updated: 2025-05-02T19:51:43.212Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: Integration of Moneybird for WooCommerce Products: Integration of Moneybird for WooCommerce Problem Types: CWE-79 Description: The Integration of Moneybird for WooCommerce WordPress plugin is vulnerable to Reflected Cross-Site Scripting via the error_description parameter found in the ~/templates/wcmb-admin.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 2.1.1. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: -
ns up to and including 2.1.1. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/vulnerability-advisories/#CVE-2021-38349 - https://plugins.trac.wordpress.org/browser/woo-moneybird/tags/2.1.1/templates/wcmb-admin.php#L8
CVE ID: CVE-2021-38350 State: PUBLISHED Published: 2021-09-10T13:32:10.290Z Last Updated: 2025-05-02T20:14:46.999Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: spideranalyse Products: spideranalyse Problem Types: CWE-79 Description: The spideranalyse WordPress plugin is vulnerable to Reflected Cross-Site Scripting via the date parameter found in the ~/analyse/index.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 0.0.1. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/vulnerability-advisories/#CVE-2021-38350 - https://plugins.trac.wordpress.o
ent: References: - https://www.wordfence.com/vulnerability-advisories/#CVE-2021-38350 - https://plugins.trac.wordpress.org/browser/spideranalyse/trunk/analyse/index.php#L33
CVE ID: CVE-2021-38351 State: PUBLISHED Published: 2021-09-10T13:32:04.778Z Last Updated: 2025-05-02T20:15:03.633Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: OSD Subscribe Products: OSD Subscribe Problem Types: CWE-79 Description: The OSD Subscribe WordPress plugin is vulnerable to Reflected Cross-Site Scripting via the osd_subscribe_message parameter found in the ~/options/osd_subscribe_options_subscribers.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 1.2.3. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/vulnerability-advisories/#CVE-
- CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/vulnerability-advisories/#CVE-2021-38351 - https://plugins.trac.wordpress.org/browser/osd-subscribe/tags/1.2.3/options/osd_subscribe_options_subscribers.php#L86
CVE ID: CVE-2021-38352 State: PUBLISHED Published: 2021-09-10T13:33:12.312Z Last Updated: 2025-05-02T20:14:13.345Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: Feedify – Web Push Notifications Products: Feedify – Web Push Notifications Problem Types: CWE-79 Description: The Feedify – Web Push Notifications WordPress plugin is vulnerable to Reflected Cross-Site Scripting via the feedify_msg parameter found in the ~/includes/base.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 2.1.8. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/vulnerabili
nal Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/vulnerability-advisories/#CVE-2021-38352 - https://plugins.trac.wordpress.org/browser/push-notification-by-feedify/tags/2.1.1/includes/base.php#L199
CVE ID: CVE-2021-38353 State: PUBLISHED Published: 2021-09-10T13:32:49.752Z Last Updated: 2025-05-02T19:52:24.115Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: Dropdown and scrollable Text Products: Dropdown and scrollable Text Problem Types: CWE-79 Description: The Dropdown and scrollable Text WordPress plugin is vulnerable to Reflected Cross-Site Scripting via the content parameter found in the ~/index.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 2.0. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/vulnerability-advisories/#CVE-2021-38
rogram Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/vulnerability-advisories/#CVE-2021-38353 - https://plugins.trac.wordpress.org/browser/dropdown-and-scrollable-text/trunk/index.php?rev=2307131#L176
CVE ID: CVE-2021-38354 State: PUBLISHED Published: 2021-09-10T13:34:42.506Z Last Updated: 2025-05-02T19:43:59.240Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: GNU-Mailman Integration Products: GNU-Mailman Integration Problem Types: CWE-79 Description: The GNU-Mailman Integration WordPress plugin is vulnerable to Reflected Cross-Site Scripting via the gm_error parameter found in the ~/includes/admin/mailing-lists-page.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 1.0.6. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/vulnerability-advisor
t Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/vulnerability-advisories/#CVE-2021-38354 - https://plugins.trac.wordpress.org/browser/gnu-mailman-integration/trunk/includes/admin/mailing-lists-page.php?rev=859898#L34
CVE ID: CVE-2021-38355 State: PUBLISHED Published: 2021-09-10T13:34:18.993Z Last Updated: 2025-05-02T19:47:11.909Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: Bug Library Products: Bug Library Problem Types: CWE-79 Description: The Bug Library WordPress plugin is vulnerable to Reflected Cross-Site Scripting via the successimportcount parameter found in the ~/bug-library.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 2.0.3. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/vulnerability-advisories/#CVE-2021-38355 - https://plugins.trac.wordp
nrichment: References: - https://www.wordfence.com/vulnerability-advisories/#CVE-2021-38355 - https://plugins.trac.wordpress.org/browser/bug-library/trunk/bug-library.php?rev=2571533#L1358
CVE ID: CVE-2021-38356 State: PUBLISHED Published: 2021-11-01T21:01:08.103Z Last Updated: 2025-03-31T17:46:39.437Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: NextScripts Products: NextScripts: Social Networks Auto-Poster Problem Types: CWE-79 Description: The NextScripts: Social Networks Auto-Poster <= 4.3.20 WordPress plugin is vulnerable to Reflected Cross-Site Scripting via the $_REQUEST['page'] parameter which is echoed out on inc/nxs_class_snap.php by supplying the appropriate value 'nxssnap-post' to load the page in $_GET['page'] along with malicious JavaScript in $_POST['page']. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnri
along with malicious JavaScript in $_POST['page']. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/blog/2021/10/xss-vulnerability-in-nextscripts-social-networks-auto-poster-plugin-impacts-100000-sites/
CVE ID: CVE-2021-38357 State: PUBLISHED Published: 2021-09-10T13:34:58.722Z Last Updated: 2025-05-02T19:43:09.410Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: SMS OVH Products: SMS OVH Problem Types: CWE-79 Description: The SMS OVH WordPress plugin is vulnerable to Reflected Cross-Site Scripting via the position parameter found in the ~/sms-ovh-sent.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 0.1. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/vulnerability-advisories/#CVE-2021-38357 - https://plugins.trac.wordpress.org/browser/sms-ov
- https://www.wordfence.com/vulnerability-advisories/#CVE-2021-38357 - https://plugins.trac.wordpress.org/browser/sms-ovh/trunk/sms-ovh-sent.php#L44
CVE ID: CVE-2021-38358 State: PUBLISHED Published: 2021-09-10T13:34:53.391Z Last Updated: 2025-05-02T19:43:25.657Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: MoolaMojo Products: MoolaMojo Problem Types: CWE-79 Description: The MoolaMojo WordPress plugin is vulnerable to Reflected Cross-Site Scripting via the classes parameter found in the ~/views/button-generator.html.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 0.7.4.1. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/vulnerability-advisories/#CVE-2021-38358 - https://plugins.trac.word
lnrichment: References: - https://www.wordfence.com/vulnerability-advisories/#CVE-2021-38358 - https://plugins.trac.wordpress.org/browser/moolamojo/trunk/views/button-generator.html.php#L16
CVE ID: CVE-2021-38359 State: PUBLISHED Published: 2021-09-10T13:34:47.488Z Last Updated: 2025-05-02T19:43:43.362Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: WordPress InviteBox Plugin Products: WordPress InviteBox Plugin Problem Types: CWE-79 Description: The WordPress InviteBox Plugin for viral Refer-a-Friend Promotions WordPress plugin is vulnerable to Reflected Cross-Site Scripting via the message parameter found in the ~/admin/admin.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 1.4.1. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com
4.1. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/vulnerability-advisories/#CVE-2021-38359 - https://plugins.trac.wordpress.org/browser/refer-a-friend-widget-for-wp/tags/1.4.1/admin/admin.php#L75
CVE ID: CVE-2021-38360 State: PUBLISHED Published: 2021-09-10T13:35:04.746Z Last Updated: 2025-03-31T18:22:52.396Z Severity: HIGH (CVSS 8.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L) Vendors: wp-publications Products: wp-publications Problem Types: CWE-22 Description: The wp-publications WordPress plugin is vulnerable to restrictive local file inclusion via the Q_FILE parameter found in the ~/bibtexbrowser.php file which allows attackers to include local zip files and achieve remote code execution, in versions up to and including 0.0. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/vulnerability-advisories/#CVE-2021-38360
ram Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/vulnerability-advisories/#CVE-2021-38360 - https://plugins.trac.wordpress.org/browser/wp-publications/trunk/bibtexbrowser.php?rev=1830330#L49
CVE ID: CVE-2021-38361 State: PUBLISHED Published: 2021-12-14T15:50:14.759Z Last Updated: 2025-02-14T17:49:20.882Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: .htaccess Redirect Products: .htaccess Redirect Problem Types: CWE-79 Description: The .htaccess Redirect WordPress plugin is vulnerable to Reflected Cross-Site Scripting via the link parameter found in the ~/htaccess-redirect.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 0.3.1. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/vulnerability-advisories/#CVE-2021-38361 - https://plugi
CISA ADP Vulnrichment: References: - https://www.wordfence.com/vulnerability-advisories/#CVE-2021-38361 - https://plugins.trac.wordpress.org/browser/htaccess-redirect/trunk/htaccess-redirect.php#L249