Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2021-24142 State: PUBLISHED Published: 2021-03-18T14:57:50 Last Updated: 2024-08-03T19:21:18.295Z Vendors: Unknown Products: 301 Redirects - Easy Redirect Manager Problem Types: CWE-89 Description: Unvaludated input in the 301 Redirects - Easy Redirect Manager WordPress plugin, versions before 2.51, did not sanitise its "Redirect From" column when importing a CSV file, allowing high privilege users to perform SQL injections. Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/19800898-d7b6-4edd-887b-dac3c0597f14
CVE ID: CVE-2021-24143 State: PUBLISHED Published: 2021-03-18T14:57:50 Last Updated: 2024-08-03T19:21:18.374Z Vendors: Unknown Products: AccessPress Social Icons Problem Types: CWE-89 Description: Unvalidated input in the AccessPress Social Icons plugin, versions before 1.8.1, did not sanitise its widget attribute, allowing accounts with post permission, such as author, to perform SQL injections. Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/02c5e10c-1ac7-447e-8ae5-b6d251be750b
CVE ID: CVE-2021-24144 State: PUBLISHED Published: 2021-03-18T14:57:50 Last Updated: 2024-08-03T19:21:18.287Z Vendors: Unknown Products: Contact Form 7 Database Addon Problem Types: CWE-74 Description: Unvalidated input in the Contact Form 7 Database Addon plugin, versions before 1.2.5.6, was prone to a vulnerability that lets remote attackers inject arbitrary formulas into CSV files. Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/143cdaff-c536-4ff9-8d64-c617511ddd48
CVE ID: CVE-2021-24145 State: PUBLISHED Published: 2021-03-18T14:57:50 Last Updated: 2024-08-03T19:21:18.213Z Vendors: Unknown Products: Modern Events Calendar Lite Problem Types: CWE-434 Description: Arbitrary file upload in the Modern Events Calendar Lite WordPress plugin, versions before 5.16.5, did not properly check the imported file, allowing PHP ones to be uploaded by administrator by using the 'text/csv' content-type in the request. Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/f42cc26b-9aab-4824-8168-b5b8571d1610 - http://packetstormsecurity.com/files/163346/WordPress-Modern-Events-Calendar-5.16.2-Shell-Upload.html - http://packets
- http://packetstormsecurity.com/files/163346/WordPress-Modern-Events-Calendar-5.16.2-Shell-Upload.html - http://packetstormsecurity.com/files/163672/WordPress-Modern-Events-Calendar-Remote-Code-Execution.html
CVE ID: CVE-2021-24146 State: PUBLISHED Published: 2021-03-18T14:57:50 Last Updated: 2024-08-03T19:21:18.297Z Vendors: Unknown Products: Modern Events Calendar Lite Problem Types: CWE-284 Description: Lack of authorisation checks in the Modern Events Calendar Lite WordPress plugin, versions before 5.16.5, did not properly restrict access to the export files, allowing unauthenticated users to exports all events data in CSV or XML format for example. Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/c7b1ebd6-3050-4725-9c87-0ea525f8fecc - http://packetstormsecurity.com/files/163345/WordPress-Modern-Events-Calendar-5.16.2-Information-Disclosure.htm
5f8fecc - http://packetstormsecurity.com/files/163345/WordPress-Modern-Events-Calendar-5.16.2-Information-Disclosure.html
CVE ID: CVE-2021-24147 State: PUBLISHED Published: 2021-03-18T14:57:50 Last Updated: 2024-08-03T19:21:18.252Z Vendors: Unknown Products: Modern Events Calendar Lite Problem Types: CWE-79 Description: Unvalidated input and lack of output encoding in the Modern Events Calendar Lite WordPress plugin, versions before 5.16.5, did not sanitise the mic_comment field (Notes on time) when adding/editing an event, allowing users with privilege as low as author to add events with a Cross-Site Scripting payload in them, which will be triggered in the frontend when viewing the event. Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/0f9ba284-5d7e-4092-8344-
ditional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/0f9ba284-5d7e-4092-8344-c68316b0146f
CVE ID: CVE-2021-24148 State: PUBLISHED Published: 2021-03-18T14:57:50 Last Updated: 2024-08-03T19:21:18.542Z Vendors: Unknown Products: MStore API Problem Types: CWE-287 Description: A business logic issue in the MStore API WordPress plugin, versions before 3.2.0, had an authentication bypass with Sign In With Apple allowing unauthenticated users to recover an authentication cookie with only an email address. Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/bf5ddc43-974d-41fa-8276-c1a27d3cc882
CVE ID: CVE-2021-24149 State: PUBLISHED Published: 2021-03-18T14:57:50 Last Updated: 2024-08-03T19:21:18.591Z Vendors: Unknown Products: Modern Events Calendar Lite Problem Types: CWE-89 Description: Unvalidated input in the Modern Events Calendar Lite WordPress plugin, versions before 5.16.6, did not sanitise the mec[post_id] POST parameter in the mec_fes_form AJAX action when logged in as an author+, leading to an authenticated SQL Injection issue. Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/26819680-22a8-4348-b63d-dc52c0d50ed0
CVE ID: CVE-2021-24150 State: PUBLISHED Published: 2021-04-05T18:27:42 Last Updated: 2024-08-03T19:21:18.365Z Vendors: Unknown Products: Like Button Rating ♥ LikeBtn Problem Types: CWE-918 Description: The LikeBtn WordPress Like Button Rating ♥ LikeBtn WordPress plugin before 2.6.32 was vulnerable to Unauthenticated Full-Read Server-Side Request Forgery (SSRF). Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/6bc6023f-a5e7-4665-896c-95afa5b638fb
CVE ID: CVE-2021-24151 State: PUBLISHED Published: 2024-01-16T15:48:54.185Z Last Updated: 2025-06-20T16:54:11.018Z Vendors: Unknown Products: WP Editor Problem Types: CWE-89 SQL Injection Description: The WP Editor WordPress plugin before 1.2.7 did not sanitise or validate its setting fields leading to an authenticated (admin+) blind SQL injection issue via an arbitrary parameter when making a request to save the settings. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/5ee77dd7-5a73-4d4e-8038-23e6e763e20c/
CVE ID: CVE-2021-24152 State: PUBLISHED Published: 2021-04-05T18:27:42 Last Updated: 2024-08-03T19:21:18.341Z Vendors: Unknown Products: Popup Builder – Responsive WordPress Pop up – Subscription & Newsletter Problem Types: CWE-79 Description: The "All Subscribers" setting page of Popup Builder was vulnerable to reflected Cross-Site Scripting. Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/597e9686-f4e2-43bf-85ef-c5967e5652bd
CVE ID: CVE-2021-24153 State: PUBLISHED Published: 2021-04-05T18:27:42 Last Updated: 2024-08-03T19:21:18.410Z Vendors: Unknown Products: Yoast SEO Problem Types: CWE-79 Description: A Stored Cross-Site Scripting vulnerability was discovered in the Yoast SEO WordPress plugin before 3.4.1, which had built-in blacklist filters which were blacklisting Parenthesis as well as several functions such as alert but bypasses were found. Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/77810044-394d-4314-b9a1-20c7dca726dc - https://plugins.trac.wordpress.org/changeset/1466243/wordpress-seo - https://packetstormsecurity.com/files/138192/
CVE ID: CVE-2021-24154 State: PUBLISHED Published: 2021-04-05T18:27:42 Last Updated: 2024-08-03T19:21:18.397Z Vendors: Unknown Products: Theme Editor Problem Types: CWE-552 Description: The Theme Editor WordPress plugin before 2.6 did not validate the GET file parameter before passing it to the download_file() function, allowing administrators to download arbitrary files on the web server, such as /etc/passwd Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/566c6836-fc3d-4dd9-b351-c3d9da9ec22e
CVE ID: CVE-2021-24155 State: PUBLISHED Published: 2021-04-05T18:27:42 Last Updated: 2024-08-03T19:21:18.269Z Vendors: Unknown Products: WordPress Backup and Migrate Plugin – Backup Guard Problem Types: CWE-434 Description: The WordPress Backup and Migrate Plugin – Backup Guard WordPress plugin before 1.6.0 did not ensure that the imported files are of the SGBP format and extension, allowing high privilege users (admin+) to upload arbitrary files, including PHP ones, leading to RCE. Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/d442acac-4394-45e4-b6bb-adf4a40960fb - http://packetstormsecurity.com/files/163382/WordPress-Backup-Guard-1.5.8-Sh
ility/d442acac-4394-45e4-b6bb-adf4a40960fb - http://packetstormsecurity.com/files/163382/WordPress-Backup-Guard-1.5.8-Shell-Upload.html - http://packetstormsecurity.com/files/163623/WordPress-Backup-Guard-Authenticated-Remote-Code-Execution.html
CVE ID: CVE-2021-24156 State: PUBLISHED Published: 2021-04-05T18:27:42 Last Updated: 2024-08-03T19:21:18.620Z Vendors: Unknown Products: Testimonial Rotator Problem Types: CWE-79 Description: Stored Cross-Site Scripting vulnerabilities in Testimonial Rotator 3.0.3 allow low privileged users (Contributor) to inject arbitrary JavaScript code or HTML without approval. This could lead to privilege escalation Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/8b6f4a77-4008-4730-9a91-fa055a8b3e68 - https://mega.nz/file/ftVSmRCC#ctqUg89CKszEuLO3eeQVazUStTPvoQD6LlbWNSMa7uA
CVE ID: CVE-2021-24157 State: PUBLISHED Published: 2021-04-05T18:27:42 Last Updated: 2024-08-03T19:21:18.299Z Vendors: Unknown Products: Orbit Fox by ThemeIsle Problem Types: CWE-79 Description: Orbit Fox by ThemeIsle has a feature to add custom scripts to the header and footer of a page or post. There were no checks to verify that a user had the unfiltered_html capability prior to saving the script tags, thus allowing lower-level users to inject scripts that could potentially be malicious. Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/28e42f4e-e38a-4bf4-b51b-d8f21c40f037 - https://www.wordfence.com/blog/2021/01/multiple-vulnerabilities-pat
vulnerability/28e42f4e-e38a-4bf4-b51b-d8f21c40f037 - https://www.wordfence.com/blog/2021/01/multiple-vulnerabilities-patched-in-orbit-fox-by-themeisle-plugin/
CVE ID: CVE-2021-24158 State: PUBLISHED Published: 2021-04-05T18:27:42 Last Updated: 2024-08-03T19:21:18.563Z Vendors: Unknown Products: Orbit Fox by ThemeIsle Problem Types: CWE-269 Description: Orbit Fox by ThemeIsle has a feature to add a registration form to both the Elementor and Beaver Builder page builders functionality. As part of the registration form, administrators can choose which role to set as the default for users upon registration. This field is hidden from view for lower-level users, however, they can still supply the user_role parameter to update the default role for registration. Additional Analyst Notes: - CVE Program Container: References: - https://www.wordfence.com/blo
lt role for registration. Additional Analyst Notes: - CVE Program Container: References: - https://www.wordfence.com/blog/2021/01/multiple-vulnerabilities-patched-in-orbit-fox-by-themeisle-plugin/ - https://wpscan.com/vulnerability/d81d0e72-9bb5-47ef-a796-3b305a4b604f
CVE ID: CVE-2021-24159 State: PUBLISHED Published: 2021-04-05T18:27:43 Last Updated: 2024-08-03T19:21:18.633Z Vendors: Unknown Products: Contact Form 7 Style Problem Types: CWE-352 Description: Due to the lack of sanitization and lack of nonce protection on the custom CSS feature, an attacker could craft a request to inject malicious JavaScript on a site using the Contact Form 7 Style WordPress plugin through 3.1.9. If an attacker successfully tricked a site’s administrator into clicking a link or attachment, then the request could be sent and the CSS settings would be successfully updated to include malicious JavaScript. Additional Analyst Notes: - CVE Program Container: References: - https
essfully updated to include malicious JavaScript. Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/363182f1-9fda-4363-8f6a-be37c4c07aa9 - https://www.wordfence.com/blog/2021/02/unpatched-vulnerability-50000-wp-sites-must-find-alternative-for-contact-form-7-style/
CVE ID: CVE-2021-24160 State: PUBLISHED Published: 2021-04-05T18:27:43 Last Updated: 2024-08-03T19:21:18.582Z Vendors: ExpressTech Products: Responsive Menu – Create Mobile-Friendly Menu, Responsive Menu Pro Problem Types: CWE-434 Description: In the Reponsive Menu (free and Pro) WordPress plugins before 4.0.4, subscribers could upload zip archives containing malicious PHP files that would get extracted to the /rmp-menu/ directory. These files could then be accessed via the front end of the site to trigger remote code execution and ultimately allow an attacker to execute commands to further infect a WordPress site. Additional Analyst Notes: - CVE Program Container: References: - https://wpsc
mmands to further infect a WordPress site. Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/066ba5d4-4aaa-4462-b106-500c1f291c37 - https://www.wordfence.com/blog/2021/02/multiple-vulnerabilities-patched-in-responsive-menu-plugin/
CVE ID: CVE-2021-24161 State: PUBLISHED Published: 2021-04-05T18:27:43 Last Updated: 2024-08-03T19:21:18.537Z Vendors: ExpressTech Products: Responsive Menu – Create Mobile-Friendly Menu, Responsive Menu Pro Problem Types: CWE-352 Description: In the Reponsive Menu (free and Pro) WordPress plugins before 4.0.4, attackers could craft a request and trick an administrator into uploading a zip archive containing malicious PHP files. The attacker could then access those files to achieve remote code execution and further infect the targeted site. Additional Analyst Notes: - CVE Program Container: References: - https://www.wordfence.com/blog/2021/02/multiple-vulnerabilities-patched-in-responsive-me
rogram Container: References: - https://www.wordfence.com/blog/2021/02/multiple-vulnerabilities-patched-in-responsive-menu-plugin/ - https://wpscan.com/vulnerability/efca27e0-bdb6-4497-8330-081f909d6933
CVE ID: CVE-2021-24162 State: PUBLISHED Published: 2021-04-05T18:27:43 Last Updated: 2024-08-03T19:21:18.635Z Vendors: ExpressTech Products: Responsive Menu – Create Mobile-Friendly Menu, Responsive Menu Pro Problem Types: CWE-352 Description: In the Reponsive Menu (free and Pro) WordPress plugins before 4.0.4, attackers could craft a request and trick an administrator into importing all new settings. These settings could be modified to include malicious JavaScript, therefore allowing an attacker to inject payloads that could aid in further infection of the site. Additional Analyst Notes: - CVE Program Container: References: - https://www.wordfence.com/blog/2021/02/multiple-vulnerabilities-p
Analyst Notes: - CVE Program Container: References: - https://www.wordfence.com/blog/2021/02/multiple-vulnerabilities-patched-in-responsive-menu-plugin/ - https://wpscan.com/vulnerability/923fc3a3-4bcc-4b48-870a-6150e14509b5
CVE ID: CVE-2021-24163 State: PUBLISHED Published: 2021-04-05T18:27:43 Last Updated: 2024-08-03T19:21:18.613Z Vendors: Unknown Products: Ninja Forms Contact Form – The Drag and Drop Form Builder for WordPress Problem Types: CWE-200 Description: The AJAX action, wp_ajax_ninja_forms_sendwp_remote_install_handler, did not have a capability check on it, nor did it have any nonce protection, therefore making it possible for low-level users, such as subscribers, to install and activate the SendWP Ninja Forms Contact Form – The Drag and Drop Form Builder for WordPress WordPress plugin before 3.4.34 and retrieve the client_secret key needed to establish the SendWP connection while also installing th
ugin before 3.4.34 and retrieve the client_secret key needed to establish the SendWP connection while also installing the SendWP plugin. Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/55fde9fa-f6cd-4546-bee8-4acc628251c2 - https://www.wordfence.com/blog/2021/02/one-million-sites-affected-four-severe-vulnerabilities-patched-in-ninja-forms/
CVE ID: CVE-2021-24164 State: PUBLISHED Published: 2021-04-05T18:27:43 Last Updated: 2024-08-03T19:21:18.626Z Vendors: Unknown Products: Ninja Forms Contact Form – The Drag and Drop Form Builder for WordPress Problem Types: CWE-200 Description: In the Ninja Forms Contact Form WordPress plugin before 3.4.34.1, low-level users, such as subscribers, were able to trigger the action, wp_ajax_nf_oauth, and retrieve the connection url needed to establish a connection. They could also retrieve the client_id for an already established OAuth connection. Additional Analyst Notes: - CVE Program Container: References: - https://www.wordfence.com/blog/2021/02/one-million-sites-affected-four-severe-vulnera
E Program Container: References: - https://www.wordfence.com/blog/2021/02/one-million-sites-affected-four-severe-vulnerabilities-patched-in-ninja-forms/ - https://wpscan.com/vulnerability/dfa32afa-c6de-4237-a9f2-709843dcda89
CVE ID: CVE-2021-24165 State: PUBLISHED Published: 2021-04-05T18:27:43 Last Updated: 2024-08-03T19:21:18.626Z Vendors: Unknown Products: Ninja Forms Contact Form – The Drag and Drop Form Builder for WordPress Problem Types: CWE-601 Description: In the Ninja Forms Contact Form WordPress plugin before 3.4.34, the wp_ajax_nf_oauth_connect AJAX action was vulnerable to open redirect due to the use of a user supplied redirect parameter and no protection in place. Additional Analyst Notes: - CVE Program Container: References: - https://www.wordfence.com/blog/2021/02/one-million-sites-affected-four-severe-vulnerabilities-patched-in-ninja-forms/ - https://wpscan.com/vulnerability/6147acf5-e43f-47e6-
ites-affected-four-severe-vulnerabilities-patched-in-ninja-forms/ - https://wpscan.com/vulnerability/6147acf5-e43f-47e6-ab56-c9c8be584818
CVE ID: CVE-2021-24166 State: PUBLISHED Published: 2021-04-05T18:27:43 Last Updated: 2024-08-03T19:21:18.612Z Vendors: Unknown Products: Ninja Forms Contact Form – The Drag and Drop Form Builder for WordPress Problem Types: CWE-352 Description: The wp_ajax_nf_oauth_disconnect from the Ninja Forms Contact Form – The Drag and Drop Form Builder for WordPress WordPress plugin before 3.4.34 had no nonce protection making it possible for attackers to craft a request to disconnect a site's OAuth connection. Additional Analyst Notes: - CVE Program Container: References: - https://www.wordfence.com/blog/2021/02/one-million-sites-affected-four-severe-vulnerabilities-patched-in-ninja-forms/ - https://w
ww.wordfence.com/blog/2021/02/one-million-sites-affected-four-severe-vulnerabilities-patched-in-ninja-forms/ - https://wpscan.com/vulnerability/b531fb65-a8ff-4150-a9a1-2a62a3c00bd6
CVE ID: CVE-2021-24167 State: PUBLISHED Published: 2021-04-05T18:27:43 Last Updated: 2024-08-03T19:21:18.623Z Vendors: Unknown Products: Web-Stat Problem Types: CWE-200 Description: When visiting a site running Web-Stat < 1.4.0, the "wts_web_stat_load_init" function used the visitor’s browser to send an XMLHttpRequest request to https://wts2.one/ajax.htm?action=lookup_WP_account. Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/e7326903-1552-4934-a611-fc0b43236d60
CVE ID: CVE-2021-24168 State: PUBLISHED Published: 2021-04-05T18:27:44 Last Updated: 2024-08-03T19:21:18.620Z Vendors: Unknown Products: Easy Contact Form Pro Problem Types: CWE-79 Description: The Easy Contact Form Pro WordPress plugin before 1.1.1.9 did not properly sanitise the text fields (such as Email Subject, Email Recipient, etc) when creating or editing a form, leading to an authenticated (author+) stored cross-site scripting issue. This could allow medium privilege accounts (such as author and editor) to perform XSS attacks against high privilege ones like administrator. Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/bfaa7d79-904e-
trator. Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/bfaa7d79-904e-45f1-bc42-ddd90a65ce74
CVE ID: CVE-2021-24169 State: PUBLISHED Published: 2021-04-05T18:27:44 Last Updated: 2024-08-03T19:21:18.795Z Vendors: Unknown Products: Advanced Order Export For WooCommerce Problem Types: CWE-79 Description: This Advanced Order Export For WooCommerce WordPress plugin before 3.1.8 helps you to easily export WooCommerce order data. The tab parameter in the Admin Panel is vulnerable to reflected XSS. Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/09681a6c-57b8-4448-982a-fe8d28c87fc3 - http://packetstormsecurity.com/files/164263/WordPress-Advanced-Order-Export-For-WooCommerce-3.1.7-Cross-Site-Scripting.html
CVE ID: CVE-2021-24170 State: PUBLISHED Published: 2021-04-05T18:27:44 Last Updated: 2024-08-03T19:21:18.636Z Vendors: Unknown Products: User Profile Picture Problem Types: CWE-200 Description: The REST API endpoint get_users in the User Profile Picture WordPress plugin before 2.5.0 returned more information than was required for its functionality to users with the upload_files capability. This included password hashes, hashed user activation keys, usernames, emails, and other less sensitive information. Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/29fc5b0e-0a5f-4484-a1e6-a0a1206726cc - https://www.wordfence.com/blog/2021/03/medium-severit
://wpscan.com/vulnerability/29fc5b0e-0a5f-4484-a1e6-a0a1206726cc - https://www.wordfence.com/blog/2021/03/medium-severity-vulnerability-patched-in-user-profile-picture-plugin/
CVE ID: CVE-2021-24171 State: PUBLISHED Published: 2021-04-05T18:27:44 Last Updated: 2024-08-03T19:21:18.699Z Vendors: Unknown Products: WooCommerce Upload Files Problem Types: CWE-434 Description: The WooCommerce Upload Files WordPress plugin before 59.4 ran a single sanitization pass to remove blocked extensions such as .php. It was possible to bypass this and upload a file with a PHP extension by embedding a "blocked" extension within another "blocked" extension in the "wcuf_file_name" parameter. It was also possible to perform a double extension attack and upload files to a different location via path traversal using the "wcuf_current_upload_session_id" parameter. Additional Analyst Note
to a different location via path traversal using the "wcuf_current_upload_session_id" parameter. Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/ed4288a1-f7e4-455f-b765-5ac343f87194 - https://www.wordfence.com/blog/2021/03/critical-vulnerability-patched-in-woocommerce-upload-files/
CVE ID: CVE-2021-24172 State: PUBLISHED Published: 2021-04-05T18:27:44 Last Updated: 2024-08-03T19:21:18.693Z Vendors: Unknown Products: VM Backups Problem Types: CWE-352 Description: The VM Backups WordPress plugin through 1.0 does not have CSRF checks, allowing attackers to make a logged in user unwanted actions, such as generate backups of the DB, plugins, and current . Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/187e6967-6961-4843-a9d5-866f6ebdb7bc
CVE ID: CVE-2021-24173 State: PUBLISHED Published: 2021-04-05T18:27:44 Last Updated: 2024-08-03T19:21:18.724Z Vendors: Unknown Products: VM Backups Problem Types: CWE-352 Description: The VM Backups WordPress plugin through 1.0 does not have CSRF checks, allowing attackers to make a logged in user unwanted actions, such as update the plugin's options, leading to a Stored Cross-Site Scripting issue. Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/b69ea1bc-3c9b-47d7-a164-c860ee46a9af