Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2021-24839 State: PUBLISHED Published: 2022-02-07T15:47:09 Last Updated: 2024-08-03T19:42:17.253Z Vendors: Unknown Products: SupportCandy – Helpdesk & Support Ticket System Problem Types: CWE-862 Description: The SupportCandy WordPress plugin before 2.2.5 does not have authorisation and CSRF checks in its wpsc_tickets AJAX action, which could allow unauthenticated users to call it and delete arbitrary tickets via the set_delete_permanently_bulk_ticket setting_action. Other actions may be affected as well. Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/5e6e63c2-2675-4b8d-9b94-c16c525a1a0e
CVE ID: CVE-2021-24840 State: PUBLISHED Published: 2021-11-08T17:35:33 Last Updated: 2024-08-03T19:42:17.205Z Vendors: Unknown Products: Squaretype Problem Types: CWE-639 Description: The Squaretype WordPress theme before 3.0.4 allows unauthenticated users to manipulate the query_vars used to retrieve the posts to display in one of its REST endpoint, without any validation. As a result, private and scheduled posts could be retrieved via a crafted request. Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/971302fd-4e8b-4c6a-818f-3a42c7fb83ef
CVE ID: CVE-2021-24841 State: PUBLISHED Published: 2021-11-17T10:15:49 Last Updated: 2024-08-03T19:42:17.215Z Vendors: Unknown Products: Helpful Problem Types: CWE-79 Description: The Helpful WordPress plugin before 4.4.59 does not sanitise and escape some of its settings, which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/55d11acf-8c47-40da-be47-24f74fd7566e - https://mikadmin.fr/tech/XSS-Stored-Helpful-5b10bc7f40ab319f9797eb4abad4f420660.pdf
CVE ID: CVE-2021-24842 State: PUBLISHED Published: 2021-11-29T08:25:40 Last Updated: 2024-08-03T19:42:17.397Z Vendors: Unknown Products: Bulk Datetime Change Problem Types: CWE-862 Description: The Bulk Datetime Change WordPress plugin before 1.12 does not enforce capability checks which allows users with Contributor roles to 1) list private post titles of other users and 2) change the posted date of other users' posts. Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/054bd981-dbdd-47dd-bad0-fa327e5860a2 - https://plugins.trac.wordpress.org/changeset/2618982
CVE ID: CVE-2021-24843 State: PUBLISHED Published: 2022-02-07T15:47:10 Last Updated: 2024-08-03T19:42:17.409Z Vendors: Unknown Products: SupportCandy – Helpdesk & Support Ticket System Problem Types: CWE-352 Description: The SupportCandy WordPress plugin before 2.2.7 does not have CRSF check in its wpsc_tickets AJAX action, which could allow attackers to make a logged in admin call it and delete arbitrary tickets via the set_delete_permanently_bulk_ticket setting_action. Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/b71f53d7-6b9e-458c-8754-576ad2a52f7d
CVE ID: CVE-2021-24844 State: PUBLISHED Published: 2021-11-08T17:35:33 Last Updated: 2024-08-03T19:42:17.420Z Vendors: Unknown Products: Affiliates Manager Problem Types: CWE-89 Description: The Affiliates Manager WordPress plugin before 2.8.7 does not validate the orderby parameter before using it in an SQL statement in the admin dashboard, leading to an SQL Injection issue Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/ebd6d13c-572e-4861-b7d1-a7a87332ce0d - https://plugins.trac.wordpress.org/changeset/2611862/
CVE ID: CVE-2021-24845 State: PUBLISHED Published: 2021-12-13T10:41:05 Last Updated: 2024-08-03T19:42:17.220Z Vendors: Unknown Products: Improved Include Page Problem Types: CWE-284 Description: The Improved Include Page WordPress plugin through 1.2 allows passing shortcode attributes with post_type & post_status which can be used to retrieve arbitrary content. This way, users with a role as low as Contributor can gain access to content they are not supposed to. Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/ab857454-7c7c-454d-9c7f-1db767961e5f
CVE ID: CVE-2021-24846 State: PUBLISHED Published: 2021-12-21T08:45:31 Last Updated: 2024-08-03T19:42:17.360Z Vendors: Unknown Products: Ni WooCommerce Custom Order Status Problem Types: CWE-89 Description: The get_query() function of the Ni WooCommerce Custom Order Status WordPress plugin before 1.9.7, used by the niwoocos_ajax AJAX action, available to all authenticated users, does not properly sanitise the sort parameter before using it in a SQL statement, leading to an SQL injection, exploitable by any authenticated users, such as subscriber Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/a1e7cd2b-8400-4c5d-8b47-a8ccd1e21675
CVE ID: CVE-2021-24847 State: PUBLISHED Published: 2021-11-17T10:15:51 Last Updated: 2024-08-03T19:42:17.342Z Vendors: Unknown Products: SEO Redirection Plugin – 301 Redirect Manager Problem Types: CWE-89 Description: The importFromRedirection AJAX action of the SEO Redirection Plugin – 301 Redirect Manager WordPress plugin before 8.2, available to any authenticated user, does not properly sanitise the offset parameter before using it in a SQL statement, leading an SQL injection when the redirection plugin is also installed Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/679ca6ed-2343-43f3-9c3e-2c12e12407c1
CVE ID: CVE-2021-24848 State: PUBLISHED Published: 2021-12-13T10:41:07 Last Updated: 2024-08-03T19:42:17.251Z Vendors: Unknown Products: Mediamatic – Media Library Folders Problem Types: CWE-89 Description: The mediamaticAjaxRenameCategory AJAX action of the Mediamatic WordPress plugin before 2.8.1, available to any authenticated user, does not sanitise the categoryID parameter before using it in a SQL statement, leading to an SQL injection Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/156d4faf-7d34-4d9f-a654-9064d4eb3aea
CVE ID: CVE-2021-24849 State: PUBLISHED Published: 2021-12-21T08:45:32 Last Updated: 2024-08-03T19:42:17.219Z Vendors: Unknown Products: WCFM Marketplace – Best Multivendor Marketplace for WooCommerce Problem Types: CWE-89 Description: The wcfm_ajax_controller AJAX action of the WCFM Marketplace WordPress plugin before 3.4.12, available to unauthenticated and authenticated user, does not properly sanitise multiple parameters before using them in SQL statements, leading to SQL injections Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/763c08a0-4b2b-4487-b91c-be6cc2b9322e
CVE ID: CVE-2021-24850 State: PUBLISHED Published: 2021-11-17T10:15:52 Last Updated: 2024-08-03T19:42:17.195Z Vendors: Unknown Products: Insert Pages Problem Types: CWE-79 Description: The Insert Pages WordPress plugin before 3.7.0 adds a shortcode that prints out other pages' content and custom fields. It can be used by users with a role as low as Contributor to perform Cross-Site Scripting attacks by storing the payload/s in another post's custom fields. Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/2d6f9be0-b9fd-48e5-bd68-94eeb3822c0a
CVE ID: CVE-2021-24851 State: PUBLISHED Published: 2021-11-17T10:15:54 Last Updated: 2024-08-03T19:42:17.425Z Vendors: Unknown Products: Insert Pages Problem Types: CWE-863 Description: The Insert Pages WordPress plugin before 3.7.0 allows users with a role as low as Contributor to access content and metadata from arbitrary posts/pages regardless of their author and status (ie private), using a shortcode. Password protected posts/pages are not affected by such issue. Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/919e67a1-3a50-4940-bb4f-5c5cc2017a83 - https://plugins.trac.wordpress.org/changeset/2614442/insert-pages
CVE ID: CVE-2021-24852 State: PUBLISHED Published: 2021-11-17T10:15:55 Last Updated: 2024-08-03T19:42:17.184Z Vendors: Unknown Products: MouseWheel Smooth Scroll Problem Types: CWE-352 Description: The MouseWheel Smooth Scroll WordPress plugin before 5.7 does not have CSRF check in place on its settings page, which could allow attackers to make a logged in admin change them via a CSRF attack Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/1069fb40-44f0-468e-9fd4-7a0fb8cde5a5
CVE ID: CVE-2021-24853 State: PUBLISHED Published: 2021-11-17T10:15:57 Last Updated: 2024-08-03T19:42:17.211Z Vendors: Unknown Products: QR Redirector Problem Types: CWE-284 Description: The QR Redirector WordPress plugin before 1.6 does not have capability and CSRF checks when saving bulk QR Redirector settings via the qr_save_bulk AJAX action, which could allow any authenticated user, such as subscriber to change the redirect response status code of arbitrary QR Redirects Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/240bed24-0315-4bbf-ba17-e4947e5ecacb
CVE ID: CVE-2021-24854 State: PUBLISHED Published: 2021-11-17T10:15:58 Last Updated: 2024-08-03T19:42:17.302Z Vendors: Unknown Products: QR Redirector Problem Types: CWE-79 Description: The QR Redirector WordPress plugin before 1.6.1 does not sanitise and escape some of the QR Redirect fields, which could allow users with a role as low as Contributor perform Stored Cross-Site Scripting attacks. Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/0d422397-69ff-4d05-aafa-7a572e460e5f
CVE ID: CVE-2021-24855 State: PUBLISHED Published: 2021-12-13T10:41:08 Last Updated: 2024-08-03T19:42:17.468Z Vendors: Unknown Products: Display Post Metadata Problem Types: CWE-79 Description: The Display Post Metadata WordPress plugin before 1.5.0 adds a shortcode to print out custom fields, however their content is not sanitised or escaped which could allow users with a role as low as Contributor to perform Cross-Site Scripting attacks Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/49328498-d3a0-4d27-8a52-24054b5e42f3
CVE ID: CVE-2021-24856 State: PUBLISHED Published: 2021-11-17T10:16:00 Last Updated: 2024-08-03T19:42:17.305Z Vendors: Unknown Products: Shared Files – Easy Download Manager and File Sharing Plugin with Frontend File Upload Problem Types: CWE-79 Description: The Shared Files WordPress plugin before 1.6.61 does not sanitise and escape the Download Counter Text settings, which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/8fd483fb-d399-4b4f-b4ef-bbfad1b5cf1b - https://mikadmin.fr/tech/XSS-Stored-Shared-Files-a837703a
pscan.com/vulnerability/8fd483fb-d399-4b4f-b4ef-bbfad1b5cf1b - https://mikadmin.fr/tech/XSS-Stored-Shared-Files-a837703ad010d111be11ffdf478aa6114F0lK656bV.pdf
CVE ID: CVE-2021-24857 State: PUBLISHED Published: 2021-12-13T10:41:09 Last Updated: 2024-08-03T19:42:17.347Z Vendors: Unknown Products: ToTop Link Problem Types: CWE-502 Description: The ToTop Link WordPress plugin through 1.7.1 passes base64 encoded user input to the unserialize() PHP function, which could lead to PHP Object injection if a plugin installed on the blog has a suitable gadget chain. Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/518204d8-fbf5-4bfa-9db5-835f908f8d8e
CVE ID: CVE-2021-24858 State: PUBLISHED Published: 2022-01-24T08:00:50 Last Updated: 2024-08-03T19:42:17.244Z Vendors: Unknown Products: Cookie Notification Plugin for WordPress – WP Cookie User Info Problem Types: CWE-89 Description: The Cookie Notification Plugin for WordPress plugin before 1.0.9 does not sanitise or escape the id GET parameter before using it in a SQL statement, when retrieving the setting to edit in the admin dashboard, leading to an authenticated SQL Injection Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/9bd1c040-09cc-4c2d-88c9-8406a653a48b
CVE ID: CVE-2021-24859 State: PUBLISHED Published: 2021-12-13T10:41:11 Last Updated: 2024-08-03T19:42:17.307Z Vendors: Unknown Products: User meta shortcodes Problem Types: CWE-284 Description: The User Meta Shortcodes WordPress plugin through 0.5 registers a shortcode that allows any user with a role as low as contributor to access other users metadata by specifying the user login as a parameter. This makes the WP instance vulnerable to data extrafiltration, including password hashes Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/958f44a5-07e7-4349-9212-2a039a082ba0
CVE ID: CVE-2021-24860 State: PUBLISHED Published: 2021-11-29T08:25:41 Last Updated: 2024-08-03T19:42:17.473Z Vendors: Unknown Products: BSK PDF Manager Problem Types: CWE-89 Description: The BSK PDF Manager WordPress plugin before 3.1.2 does not validate and escape the orderby and order parameters before using them in a SQL statement, leading to a SQL injection issue Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/d5891973-37d0-48cb-a5a3-a26c771b3369
CVE ID: CVE-2021-24861 State: PUBLISHED Published: 2021-12-13T10:41:12 Last Updated: 2024-08-03T19:49:12.681Z Vendors: Unknown Products: Quotes Collection Problem Types: CWE-89 Description: The Quotes Collection WordPress plugin through 2.5.2 does not validate and escape the bulkcheck parameter before using it in a SQL statement, leading to a SQL injection Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/9a50d5d0-7a50-47d1-a8f9-e0eb217919d9
CVE ID: CVE-2021-24862 State: PUBLISHED Published: 2022-01-10T15:30:30 Last Updated: 2024-08-03T19:49:13.521Z Vendors: Unknown Products: RegistrationMagic – Custom Registration Forms, User Registration and User Login Plugin Problem Types: CWE-89 Description: The RegistrationMagic WordPress plugin before 5.0.1.6 does not escape user input in its rm_chronos_ajax AJAX action before using it in a SQL statement when duplicating tasks in batches, which could lead to a SQL injection issue Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/7d3af3b5-5548-419d-aa32-1f7b51622615 - http://packetstormsecurity.com/files/165746/WordPress-RegistrationMagic-V-5.
lity/7d3af3b5-5548-419d-aa32-1f7b51622615 - http://packetstormsecurity.com/files/165746/WordPress-RegistrationMagic-V-5.0.1.5-SQL-Injection.html - https://github.com/Hacker5preme/Exploits/tree/main/Wordpress/CVE-2021-24862
CVE ID: CVE-2021-24863 State: PUBLISHED Published: 2021-12-13T10:41:14 Last Updated: 2024-08-03T19:49:12.639Z Vendors: Unknown Products: WP Block and Stop Bad Bots Crawlers and Spiders and Anti Spam Protection Plugin StopBadBots Problem Types: CWE-89 Description: The WP Block and Stop Bad Bots Crawlers and Spiders and Anti Spam Protection Plugin StopBadBots WordPress plugin before 6.67 does not sanitise and escape the User Agent before using it in a SQL statement to save it, leading to a SQL injection Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/1e4dd002-6c96-44f9-bd55-61359265f7ae
CVE ID: CVE-2021-24864 State: PUBLISHED Published: 2022-02-28T09:06:13 Last Updated: 2024-08-03T19:49:13.903Z Vendors: Unknown Products: WP Cloudy, weather plugin Problem Types: CWE-89 Description: The WP Cloudy, weather plugin WordPress plugin before 4.4.9 does not escape the post_id parameter before using it in a SQL statement in the admin dashboard, leading to a SQL Injection issue Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/e3b9ee9f-602d-4e9d-810c-e1e3ba604464 - https://plugins.trac.wordpress.org/changeset/2615400
CVE ID: CVE-2021-24865 State: PUBLISHED Published: 2022-01-24T08:00:52 Last Updated: 2024-08-03T19:49:12.651Z Vendors: Unknown Products: Advanced Custom Fields: Extended Problem Types: CWE-89 Description: The Advanced Custom Fields: Extended WordPress plugin before 0.8.8.7 does not validate the order and orderby parameters before using them in a SQL statement, leading to a SQL Injection issue Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/055a2dcf-77ec-4e54-be7d-9c47f7730d1b - https://plugins.trac.wordpress.org/changeset/2648200
CVE ID: CVE-2021-24866 State: PUBLISHED Published: 2021-12-06T15:55:27 Last Updated: 2024-08-03T19:49:13.461Z Vendors: Unknown Products: WP Data Access Problem Types: CWE-89 Description: The WP Data Access WordPress plugin before 5.0.0 does not properly sanitise and escape the backup_date parameter before using it a SQL statement, leading to a SQL injection issue and could allow arbitrary table deletion Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/a9073616-ffd6-4956-b2e7-0fb2eac6e9b5
CVE ID: CVE-2021-24867 State: PUBLISHED Published: 2022-02-21T10:45:39 Last Updated: 2024-08-03T19:49:13.412Z Vendors: AccessPress Themes Products: Frontend Post WordPress Plugin – AccessPress Anonymous Post, AccessPress Custom CSS, AccessPress Custom Post Type, Social Auto Poster, AccessPress iFeeds, PI Button, AccessPress Social Counter, AccessPress Social Icons, AccessPress Social Login Lite – Social Login WordPress Plugin, AccessPress Social Share, TAuto Poster, WP TFeed, Effectively Add & Customize Free Icons For WordPress Menus – WP Menu Icons Lite, AP Companion, Easiest Contact Form for WordPress – AP Contact Form, Testimonial WordPress Plugin – AP Custom Testimonial, Mega Menu Plugin
est Contact Form for WordPress – AP Contact Form, Testimonial WordPress Plugin – AP Custom Testimonial, Mega Menu Plugin for WordPress – AP Mega Menu, Pricing Table Builder – AP Pricing Tables Lite, Responsive Notification Bar Plugin for WordPress – Apex Notification Bar Lite, Form Store to DB, Comments Disable – AccessPress, CTA plugin for WordPress – Easy Side Tab, WordPress Backend Customizer – Everest Admin Theme Lite, Ultimate Coming Soon, Maintenance Mode Plugin for WordPress – Everest Coming Soon Lite, Free WordPress Plugin To Display Like/Dislike Comment Rating – Everest Comment Rating Lite, Beautiful Stat Counter Plugin for WordPress – Everest Counter Lite, Beautiful FAQ Plugin for
erest Comment Rating Lite, Beautiful Stat Counter Plugin for WordPress – Everest Counter Lite, Beautiful FAQ Plugin for WordPress – Everest FAQ Manager Lite, Responsive Media Gallery Plugin for WordPress – Everest Gallery Lite, Everest GPlaces Business Reviews, Everest Review Lite – User/Admin review plugin for WordPress, Free Responsive Tab Plugin For WordPress – Everest Tab Lite, Responsive WordPress Timeline Plugin – Everest Timeline Lite, Inline Call To Action Builder Lite – Free Call To Action Layer Plugin for WordPress, Product Slider For WooCommerce Lite, Responsive Clients Logo Gallery Plugin for WordPress – Smart Logo Showcase Lite, Smart Scroll Posts for WordPress, Faster and Easie
Clients Logo Gallery Plugin for WordPress – Smart Logo Showcase Lite, Smart Scroll Posts for WordPress, Faster and Easier scroll to Top Plugin for WordPress – Smart Scroll to Top Lite, Total GDPR Compliance Lite – WordPress Plugin for GDPR Compatibility, Total Team Lite – Responsive Team Manager / Showcase Plugin for WordPress, Free Responsive Post/Article Author Section Plugin for WordPress – Ultimate Author Box Lite, Contact Form for WordPress – Ultimate Form Builder Lite, Badge Designer Lite For WooCommerce, WordPress Slider Plugin – WP 1 Slider, Plugin to Manage / Design WordPress Blog – WP Blog Manager Lite, Smartest Way To Design & Customize WordPress Comments & Comment Form – WP Comme
n WordPress Blog – WP Blog Manager Lite, Smartest Way To Design & Customize WordPress Comments & Comment Form – WP Comment Designer Lite, Cookie Notification Plugin for WordPress – WP Cookie User Info, Social Review, MContact Button, WP Floating Menu – One page navigator, sticky menu for WordPress, The Easiest WordPress Media Manager Plugin – WP Media Manager Lite, WP Popup Banners, WP Popup Lite – Responsive popup plugin for WordPress, Responsive Products Showcase Listing for WordPress – WP Product Gallery Lite, accessbuddy, Accesspress Basic, Accesspress Lite, Accesspress Mag, AccessPress Parallax, accesspress-ray, AccessPress Root, AccessPress Staple, AccessPress Store, Agency Lite, Aplit
Mag, AccessPress Parallax, accesspress-ray, AccessPress Root, AccessPress Staple, AccessPress Store, Agency Lite, Aplite, Bingle, Bloger, Construction Lite, Doko, Enlighten, FashStore, FotoGraphy, Gaga Corp, Gaga Lite, One Paze, parallax-blog, ParallaxSome, Punte, Revolve, Ripple, ScrollMe, SportsMag, StoreVilla, Swing Lite, The Launcher, The Monday, Uncode Lite, Unicon Lite, VMag, VMagazine Lite, Vmagazine News, Zigcy Baby, Zigcy Cosmetics, Zigcy Lite Problem Types: CWE-912 Description: Numerous Plugins and Themes from the AccessPress Themes (aka Access Keys) vendor are backdoored due to their website being compromised. Only plugins and themes downloaded via the vendor website are affected
ackdoored due to their website being compromised. Only plugins and themes downloaded via the vendor website are affected, and those hosted on wordpress.org are not. However, all of them were updated or removed to avoid any confusion Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/9c76bada-fa32-4c2f-9855-d0efd1e63eff - https://jetpack.com/2022/01/18/backdoor-found-in-themes-and-plugins-from-accesspress-themes/
CVE ID: CVE-2021-24868 State: PUBLISHED Published: 2022-02-01T12:21:27 Last Updated: 2024-08-03T19:49:14.356Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Document Embedder WordPress plugin before 1.7.9 contains a AJAX action endpoint, which could allow any authenticated user, such as subscriber to enumerate the title of arbitrary private and draft posts. Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/45a43927-a427-46bc-9c61-e0b8532c8138
CVE ID: CVE-2021-24869 State: PUBLISHED Published: 2024-01-16T15:49:39.970Z Last Updated: 2025-06-02T15:10:51.510Z Vendors: Unknown Products: WP Fastest Cache Problem Types: CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') Description: The WP Fastest Cache WordPress plugin before 0.9.5 does not escape user input in the set_urls_with_terms method before using it in a SQL statement, leading to an SQL injection exploitable by low privilege users such as subscriber Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/b2233795-1a32-45fc-9d51-b6bd0a073f5b/ - https://jetpack.com/2021/10/
ent: References: - https://wpscan.com/vulnerability/b2233795-1a32-45fc-9d51-b6bd0a073f5b/ - https://jetpack.com/2021/10/14/multiple-vulnerabilities-in-wp-fastest-cache-plugin/
CVE ID: CVE-2021-24870 State: PUBLISHED Published: 2024-01-16T15:49:40.356Z Last Updated: 2025-05-12T14:43:12.736Z Vendors: Unknown Products: WP Fastest Cache Problem Types: CWE-352 Cross-Site Request Forgery (CSRF), CWE-79 Cross-Site Scripting (XSS) Description: The WP Fastest Cache WordPress plugin before 0.9.5 is lacking a CSRF check in its wpfc_save_cdn_integration AJAX action, and does not sanitise and escape some the options available via the action, which could allow attackers to make logged in high privilege users call it and set a Cross-Site Scripting payload Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/48
ional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/48de63ab-2ef1-4469-8fc4-9346068bdf06/ - https://jetpack.com/2021/10/14/multiple-vulnerabilities-in-wp-fastest-cache-plugin/