Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2021-24982 State: PUBLISHED Published: 2022-03-14T14:41:07 Last Updated: 2024-08-03T19:49:14.172Z Vendors: Unknown Products: Child Theme Generator Problem Types: CWE-79 Description: The Child Theme Generator WordPress plugin through 2.2.7 does not sanitise escape the parade parameter before outputting it back, leading to a Reflected Cross-Site Scripting in the admin dashboard Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/8e53f15e-8b6a-4d47-a40d-4ebbe6934286
CVE ID: CVE-2021-24983 State: PUBLISHED Published: 2022-02-01T12:21:34 Last Updated: 2024-08-03T19:49:14.271Z Vendors: Unknown Products: Asset CleanUp: Page Speed Booster Problem Types: CWE-79 Description: The Asset CleanUp: Page Speed Booster WordPress plugin before 1.3.8.5 does not sanitise and escape POSted parameters sent to the wpassetcleanup_fetch_active_plugins_icons AJAX action (available to admin users), leading to a Reflected Cross-Site Scripting issue Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/31fdabb0-bc74-4d25-b0cd-c872aae6cb2f
CVE ID: CVE-2021-24984 State: PUBLISHED Published: 2021-12-27T10:33:24 Last Updated: 2024-08-03T19:49:14.596Z Vendors: Unknown Products: WPFront User Role Editor Problem Types: CWE-79 Description: The WPFront User Role Editor WordPress plugin before 3.2.1.11184 does not sanitise and escape the changes-saved parameter before outputting it back in the admin dashboard, leading to a Reflected Cross-Site Scripting Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/96bb2fba-4b18-4c29-8344-3ba4d2f06a19
CVE ID: CVE-2021-24985 State: PUBLISHED Published: 2022-01-24T08:01:04 Last Updated: 2024-08-03T19:49:14.541Z Vendors: Unknown Products: Easy Forms for Mailchimp Problem Types: CWE-79 Description: The Easy Forms for Mailchimp WordPress plugin before 6.8.6 does not sanitise and escape the field_name and field_type parameters before outputting them back in attributes, leading to Reflected Cross-Site Scripting issues Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/50be0ebf-fe6d-41e5-8af9-0d74f33aeb57 - https://plugins.trac.wordpress.org/changeset/2646017
CVE ID: CVE-2021-24986 State: PUBLISHED Published: 2022-04-11T14:40:35 Last Updated: 2024-08-03T19:49:14.581Z Vendors: Unknown Products: Post Grid Problem Types: CWE-79 Description: The Post Grid WordPress plugin before 2.1.16 does not escape the keyword parameter before outputting it back in an attribute, leading to a Reflected Cross-Site Scripting in pages containing a Post Grid with a search form Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/51e57f25-b8b2-44ca-9162-d7328eac64eb
CVE ID: CVE-2021-24987 State: PUBLISHED Published: 2022-04-11T14:40:37 Last Updated: 2024-08-03T19:49:14.556Z Vendors: Unknown Products: Social Share, Social Login and Social Comments Plugin – Super Socializer Problem Types: CWE-79 Description: The Social Share, Social Login and Social Comments Plugin WordPress plugin before 7.13.30 does not sanitise and escape the urls parameter in its the_champ_sharing_count AJAX action (available to both unauthenticated and authenticated users) before outputting it back in the response, leading to a Reflected Cross-Site Scripting issue. Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/a14b668f-812f-46ee-827
Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/a14b668f-812f-46ee-827e-0996b378f7f0
CVE ID: CVE-2021-24988 State: PUBLISHED Published: 2021-12-27T10:33:24 Last Updated: 2024-08-03T19:49:14.547Z Vendors: Unknown Products: WP RSS Aggregator – News Feeds, Autoblogging, Youtube Video Feeds and More Problem Types: CWE-79 Description: The WP RSS Aggregator WordPress plugin before 4.19.3 does not sanitise and escape data before outputting it in the System Info admin dashboard, which could lead to a Stored XSS issue due to the wprss_dismiss_addon_notice AJAX action missing authorisation and CSRF checks, allowing any authenticated users, such as subscriber to call it and set a malicious payload in the addon parameter. Additional Analyst Notes: - CVE Program Container: References: -
it and set a malicious payload in the addon parameter. Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/0742483b-6314-451b-a63a-536fd1e14845
CVE ID: CVE-2021-24989 State: PUBLISHED Published: 2022-01-24T08:01:05 Last Updated: 2024-08-03T19:49:14.541Z Vendors: Unknown Products: Accept Donations with PayPal Problem Types: CWE-352 Description: The Accept Donations with PayPal WordPress plugin before 1.3.4 does not have CSRF check in place and does not ensure that the post to be deleted belongs to the plugin, allowing attackers to make a logged in admin delete arbitrary posts from the blog Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/82c2ead1-1d3c-442a-ae68-359a4748447f
CVE ID: CVE-2021-24991 State: PUBLISHED Published: 2022-01-03T12:49:10 Last Updated: 2024-08-03T19:49:14.528Z Vendors: Unknown Products: WooCommerce PDF Invoices & Packing Slips Problem Types: CWE-79 Description: The WooCommerce PDF Invoices & Packing Slips WordPress plugin before 2.10.5 does not escape the tab and section parameters before outputting it back in an attribute, leading to a Reflected Cross-Site Scripting in the admin dashboard Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/88e706df-ae03-4665-94a3-db226e1f31a9
CVE ID: CVE-2021-24992 State: PUBLISHED Published: 2021-12-27T10:33:25 Last Updated: 2024-08-03T19:49:14.555Z Vendors: Unknown Products: Smart Floating / Sticky Buttons – Call, Sharing, Chat Widgets & More – Buttonizer Problem Types: CWE-79 Description: The Smart Floating / Sticky Buttons WordPress plugin before 2.5.5 does not sanitise and escape some parameter before outputting them in attributes and page, which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed. Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/db0b9480-2ff4-423c-a745-68e983ffa12b
CVE ID: CVE-2021-24993 State: PUBLISHED Published: 2022-02-07T15:47:14 Last Updated: 2024-08-03T19:49:14.524Z Vendors: Unknown Products: Ultimate Product Catalog – WordPress Catalog Plugin Problem Types: CWE-862 Description: The Ultimate Product Catalog WordPress plugin before 5.0.26 does not have authorisation and CSRF checks in some AJAX actions, which could allow any authenticated users, such as subscriber to call them and add arbitrary products, or change the plugin's settings for example Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/514416fa-d915-4953-bf1b-6dbf40b4d7e5 - https://plugins.trac.wordpress.org/changeset/2650578
CVE ID: CVE-2021-24994 State: PUBLISHED Published: 2022-02-28T09:06:27 Last Updated: 2024-08-03T19:49:14.585Z Vendors: Unknown Products: Migration, Backup, Staging – WPvivid Backup and Migration Plugin Problem Types: CWE-79 Description: The Migration, Backup, Staging WordPress plugin before 0.9.69 does not have authorisation when adding remote storages, and does not sanitise as well as escape a parameter from such unauthenticated requests before outputting it in admin page, leading to a Stored Cross-Site Scripting issue Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/ea74257a-f6b0-49e9-a81f-53c0eb81b1da
CVE ID: CVE-2021-24995 State: PUBLISHED Published: 2022-03-14T14:41:09 Last Updated: 2024-08-03T19:49:14.586Z Vendors: Unknown Products: HTML5 Responsive FAQ Problem Types: CWE-79 Description: The HTML5 Responsive FAQ WordPress plugin through 2.8.5 does not properly sanitise and escape some of its settings, which could allow a high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html is disallowed Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/3caf0de0-57f2-4c87-8713-d00a7db9eeef
CVE ID: CVE-2021-24996 State: PUBLISHED Published: 2022-03-14T14:41:10 Last Updated: 2024-08-03T19:49:14.589Z Vendors: Unknown Products: IDPay for Contact Form 7 Problem Types: CWE-79 Description: The IDPay for Contact Form 7 WordPress plugin through 2.1.2 does not sanitise and escape the idpay_error parameter before outputting it back in the page leading to a Reflected Cross-Site Scripting Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/6ee14423-f7ff-4433-987a-a1a6b7bd65e3
CVE ID: CVE-2021-24997 State: PUBLISHED Published: 2021-12-27T10:33:26 Last Updated: 2024-08-03T19:49:14.595Z Vendors: Unknown Products: WP Guppy Problem Types: CWE-862 Description: The WP Guppy WordPress plugin before 1.3 does not have any authorisation in some of the REST API endpoints, allowing any user to call them and could lead to sensitive information disclosure, such as usernames and chats between users, as well as be able to send messages as an arbitrary user Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/747e6c7e-a167-4d82-b6e6-9e8613f0e900 - https://github.com/Keyvanhardani/WP-Guppy-A-live-chat-WP-JSON-API-Sensitive-Information-Di
a167-4d82-b6e6-9e8613f0e900 - https://github.com/Keyvanhardani/WP-Guppy-A-live-chat-WP-JSON-API-Sensitive-Information-Disclosure
CVE ID: CVE-2021-24998 State: PUBLISHED Published: 2021-12-27T10:33:26 Last Updated: 2024-08-03T19:49:14.542Z Vendors: Unknown Products: Simple JWT Login Problem Types: CWE-330 Use of Insufficiently Random Values Description: The Simple JWT Login WordPress plugin before 3.3.0 can be used to create new WordPress user accounts with a randomly generated password. The password is generated using the str_shuffle PHP function that "does not generate cryptographically secure values, and should not be used for cryptographic purposes" according to PHP's documentation. Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/1cca404e-766a-43ab-b41f-77d6a3b282fb
lyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/1cca404e-766a-43ab-b41f-77d6a3b282fb - https://plugins.trac.wordpress.org/changeset/2613782
CVE ID: CVE-2021-24999 State: PUBLISHED Published: 2022-01-03T12:49:10 Last Updated: 2024-08-03T19:49:14.549Z Vendors: Unknown Products: Booster for WooCommerce Problem Types: CWE-79 Description: The Booster for WooCommerce WordPress plugin before 5.4.9 does not sanitise and escape the wcj_notice parameter before outputting it back in the admin dashboard when the Pdf Invoicing module is enabled, leading to a Reflected Cross-Site Scripting Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/8527f4fe-312f-45c1-ae4c-7e799702fc26
CVE ID: CVE-2021-25000 State: PUBLISHED Published: 2022-01-03T12:49:11 Last Updated: 2024-08-03T19:49:14.547Z Vendors: Unknown Products: Booster for WooCommerce Problem Types: CWE-79 Description: The Booster for WooCommerce WordPress plugin before 5.4.9 does not sanitise and escape the wcj_delete_role parameter before outputting back in the admin dashboard when the General module is enabled, leading to a Reflected Cross-Site Scripting issue Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/bc167b3a-24ee-4988-9934-189b6216ce40
CVE ID: CVE-2021-25001 State: PUBLISHED Published: 2022-01-03T12:49:12 Last Updated: 2024-08-03T19:49:14.584Z Vendors: Unknown Products: Booster for WooCommerce Problem Types: CWE-79 Description: The Booster for WooCommerce WordPress plugin before 5.4.9 does not sanitise and escape the wcj_create_products_xml_result parameter before outputting back in the admin dashboard when the Product XML Feeds module is enabled, leading to a Reflected Cross-Site Scripting issue Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/76f0257d-aae7-4054-9b3d-ba10b4005cf1
CVE ID: CVE-2021-25002 State: PUBLISHED Published: 2022-05-02T16:05:29 Last Updated: 2024-08-03T19:49:14.548Z Vendors: Unknown Products: Tipsacarrier Problem Types: CWE-862 Description: The Tipsacarrier WordPress plugin before 1.5.0.5 does not have any authorisation check in place some functions, which could allow unauthenticated users to access Orders data which could be used to retrieve the client full address, name and phone via tracking URL Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/b14f476e-3124-4cbf-91b4-ae53c4dabd7c
CVE ID: CVE-2021-25003 State: PUBLISHED Published: 2022-03-14T14:41:11 Last Updated: 2024-08-03T19:49:14.534Z Vendors: Unknown Products: WPCargo Track & Trace Problem Types: CWE-94 Description: The WPCargo Track & Trace WordPress plugin before 6.9.0 contains a file which could allow unauthenticated attackers to write a PHP file anywhere on the web server, leading to RCE Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/5c21ad35-b2fb-4a51-858f-8ffff685de4a
CVE ID: CVE-2021-25004 State: PUBLISHED Published: 2022-02-07T15:47:15 Last Updated: 2024-08-03T19:49:14.557Z Vendors: Unknown Products: SEUR Oficial Problem Types: CWE-552 Description: The SEUR Oficial WordPress plugin before 1.7.2 creates a PHP file with a random name when installed, even though it is used for support purposes, it allows to download any file from the web server without restriction after knowing the URL and a password than an administrator can see in the plugin settings page. Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/cfbc2b43-b8f8-4bcb-a3d3-39d217afa530
CVE ID: CVE-2021-25005 State: PUBLISHED Published: 2022-01-17T13:00:30 Last Updated: 2024-08-03T19:49:14.588Z Vendors: Unknown Products: SEUR Oficial Problem Types: CWE-79 Description: The SEUR Oficial WordPress plugin before 1.7.0 does not sanitize and escape some of its settings allowing high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/af7d62ca-09b3-41c8-b771-be936ce8f6b2
CVE ID: CVE-2021-25006 State: PUBLISHED Published: 2022-03-14T14:41:13 Last Updated: 2024-08-03T19:49:14.557Z Vendors: Unknown Products: MOLIE – Instructure Canvas Linking tool Problem Types: CWE-79 Description: The MOLIE WordPress plugin through 0.5 does not escape the course_id parameter before outputting it back in the admin dashboard, leading to a Reflected Cross-Site Scripting issue Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/dbe2c6ca-d2f1-40a2-83d5-4623c22d4d61
CVE ID: CVE-2021-25007 State: PUBLISHED Published: 2022-03-14T14:41:14 Last Updated: 2024-08-03T19:49:14.552Z Vendors: Unknown Products: MOLIE – Instructure Canvas Linking tool Problem Types: CWE-89 Description: The MOLIE WordPress plugin through 0.5 does not validate and escape a post parameter before using in a SQL statement, leading to an SQL Injection Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/cf907d53-cc4a-4b02-bed3-64754128112c
CVE ID: CVE-2021-25008 State: PUBLISHED Published: 2022-01-24T08:01:07 Last Updated: 2024-08-03T19:49:14.599Z Vendors: Unknown Products: Code Snippets Problem Types: CWE-79 Description: The Code Snippets WordPress plugin before 2.14.3 does not escape the snippets-safe-mode parameter before outputting it back in attributes, leading to a Reflected Cross-Site Scripting issue Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/cb232354-f74d-48bb-b437-7bdddd1df42a
CVE ID: CVE-2021-25009 State: PUBLISHED Published: 2022-03-07T08:16:13 Last Updated: 2024-08-03T19:49:14.540Z Vendors: Unknown Products: CorreosExpress – Shipping Management – Tags Problem Types: CWE-532 Description: The CorreosExpress WordPress plugin through 2.6.0 generates log files which are publicly accessible, and contain sensitive information such as sender/receiver names, phone numbers, physical and email addresses Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/ce2e3503-9a06-4f5c-ae0f-f40e7dfb2903
CVE ID: CVE-2021-25010 State: PUBLISHED Published: 2022-02-28T09:06:28 Last Updated: 2024-08-03T19:49:14.589Z Vendors: Unknown Products: Post Snippets Problem Types: CWE-352 Description: The Post Snippets WordPress plugin before 3.1.4 does not have CSRF check when importing files, allowing attacker to make a logged In admin import arbitrary snippets. Furthermore, imported snippers are not sanitised and escaped, which could lead to Stored Cross-Site Scripting issues Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/d1ebd15a-72ab-4ba2-a212-7e2eea0b0fb0
CVE ID: CVE-2021-25011 State: PUBLISHED Published: 2022-02-28T09:06:30 Last Updated: 2024-08-03T19:49:14.559Z Vendors: Unknown Products: Maps Plugin using Google Maps for WordPress – WP Google Map Problem Types: CWE-862 Description: The Maps Plugin using Google Maps for WordPress plugin before 1.8.1 does not have proper authorisation and CSRF in most of its AJAX actions, which could allow any authenticated users, such as subscriber to delete arbitrary posts and update the plugin's settings. Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/6639da0d-6d29-46c1-a3cc-5e5626305833 - https://plugins.trac.wordpress.org/changeset/2641450
CVE ID: CVE-2021-25012 State: PUBLISHED Published: 2022-03-28T17:21:28 Last Updated: 2024-08-03T19:49:14.598Z Vendors: Unknown Products: Pz-LinkCard Problem Types: CWE-79 Description: The Pz-LinkCard WordPress plugin through 2.4.4.4 does not sanitise and escape multiple parameters before outputting them back in admin dashboard pages, leading to Reflected Cross-Site Scripting issues Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/b126d2fc-6cc7-4c18-b95e-d32c2effcc4f
CVE ID: CVE-2021-25013 State: PUBLISHED Published: 2022-01-24T08:01:08 Last Updated: 2024-08-03T19:49:14.630Z Vendors: Unknown Products: Qubely – Advanced Gutenberg Blocks Problem Types: CWE-862 Description: The Qubely WordPress plugin before 1.7.8 does not have authorisation and CSRF check on the qubely_delete_saved_block AJAX action, and does not ensure that the block to be deleted belong to the plugin, as a result, any authenticated users, such as subscriber can delete arbitrary posts Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/e88b7a70-ee71-439f-b3c6-0300adb980b0
CVE ID: CVE-2021-25014 State: PUBLISHED Published: 2022-02-14T09:20:42 Last Updated: 2024-08-03T19:49:14.530Z Vendors: Unknown Products: Ibtana – WordPress Website Builder Problem Types: CWE-862 Description: The Ibtana WordPress plugin before 1.1.4.9 does not have authorisation and CSRF checks in the ive_save_general_settings AJAX action, allowing any authenticated users, such as subscriber to call it and change the plugin's settings which could lead to Stored Cross-Site Scripting issue. Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/63c58d7f-8e0b-4aa5-b3c8-8726b4f19bf1
CVE ID: CVE-2021-25015 State: PUBLISHED Published: 2022-01-24T08:01:09 Last Updated: 2024-08-03T19:49:14.601Z Vendors: Unknown Products: myCred – Points, Rewards, Gamification, Ranks, Badges & Loyalty Plugin Problem Types: CWE-79 Description: The myCred WordPress plugin before 2.4 does not sanitise and escape the search query before outputting it back in the history dashboard page, leading to a Reflected Cross-Site Scripting issue Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/7608829d-2820-49e2-a10e-e93eb3005f68 - https://plugins.trac.wordpress.org/changeset/2648350/mycred
CVE ID: CVE-2021-25016 State: PUBLISHED Published: 2022-01-03T12:49:12 Last Updated: 2024-08-03T19:49:14.553Z Vendors: Unknown Products: Floating Chat Widget: Contact Icons, Messages, Telegram, Email, SMS, Call Button – Chaty, Floating Chat Widget Pro - Chaty Pro Problem Types: CWE-79 Description: The Chaty WordPress plugin before 2.8.3 and Chaty Pro WordPress plugin before 2.8.2 do not sanitise and escape the search parameter before outputting it back in the admin dashboard, leading to a Reflected Cross-Site Scripting Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/b5035987-6227-4fc6-bc45-1e8016e5c4c0
CVE ID: CVE-2021-25017 State: PUBLISHED Published: 2022-01-24T08:01:11 Last Updated: 2024-08-03T19:49:14.592Z Vendors: Unknown Products: Tutor LMS – eLearning and online course solution Problem Types: CWE-79 Description: The Tutor LMS WordPress plugin before 1.9.12 does not escape the search parameter before outputting it back in an attribute in an admin page, leading to a Reflected Cross-Site Scripting Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/2d0c4872-a341-4974-926c-10b094a5d13c - https://plugins.trac.wordpress.org/changeset/2643821
CVE ID: CVE-2021-25018 State: PUBLISHED Published: 2022-02-14T09:20:43 Last Updated: 2024-08-03T19:49:14.554Z Vendors: Unknown Products: PPOM for WooCommerce Problem Types: CWE-862 Description: The PPOM for WooCommerce WordPress plugin before 24.0 does not have authorisation and CSRF checks in the ppom_settings_panel_action AJAX action, allowing any authenticated to call it and set arbitrary settings. Furthermore, due to the lack of sanitisation and escaping, it could lead to Stored XSS issues Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/9e092aad-0b36-45a9-8987-8d904b34fbb2
CVE ID: CVE-2021-25019 State: PUBLISHED Published: 2022-03-21T18:55:39 Last Updated: 2024-08-03T19:49:14.529Z Vendors: Unknown Products: SEO Plugin by Squirrly SEO Problem Types: CWE-79 Description: The SEO Plugin by Squirrly SEO WordPress plugin before 11.1.12 does not escape the type parameter before outputting it back in an attribute in an admin page, leading to a Reflected Cross-Site Scripting Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/cea0ce4b-886a-47cc-8653-a297e9759d09
CVE ID: CVE-2021-25020 State: PUBLISHED Published: 2022-01-03T12:49:13 Last Updated: 2024-08-03T19:49:14.597Z Vendors: Unknown Products: CAOS | Host Google Analytics Locally Problem Types: CWE-22 Description: The CAOS | Host Google Analytics Locally WordPress plugin before 4.1.9 does not validate the cache directory setting, allowing high privilege users to use a path traversal vector and delete arbitrary folders when uninstalling the plugin Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/67398332-b93e-46ae-8904-68419949a124
CVE ID: CVE-2021-25021 State: PUBLISHED Published: 2022-01-03T12:49:14 Last Updated: 2024-08-03T19:49:14.646Z Vendors: Unknown Products: OMGF | Host Google Fonts Locally Problem Types: CWE-22 Description: The OMGF | Host Google Fonts Locally WordPress plugin before 4.5.12 does not validate the cache directory setting, allowing high privilege users to use a path traversal vector and delete arbitrary folders when uninstalling the plugin Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/92db763c-ca6b-43cf-87ff-c1678cf4ade5