Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
xt’ parameter containing JavaScript, which will then be executed when the saved page is viewed or previewed. Additional Analyst Notes: - CVE Program Container: References: - https://www.wordfence.com/blog/2021/03/cross-site-scripting-vulnerabilities-in-elementor-impact-over-7-million-sites/ - https://wpscan.com/vulnerability/aa152ad0-5b3d-4d1f-88f4-6899a546e72e
CVE ID: CVE-2021-24204 State: PUBLISHED Published: 2021-04-05T18:27:46 Last Updated: 2024-08-03T19:21:18.718Z Vendors: Unknown Products: Elementor Website Builder Problem Types: CWE-79 Description: In the Elementor Website Builder WordPress plugin before 3.1.4, the accordion widget (includes/widgets/accordion.php) accepts a ‘title_html_tag’ parameter. Although the element control lists a fixed set of possible html tags, it is possible for a user with Contributor or above permissions to send a modified ‘save_builder’ request containing JavaScript in the ‘title_html_tag’ parameter, which is not filtered and is output without escaping. This JavaScript will then be executed when the saved page i
meter, which is not filtered and is output without escaping. This JavaScript will then be executed when the saved page is viewed or previewed. Additional Analyst Notes: - CVE Program Container: References: - https://www.wordfence.com/blog/2021/03/cross-site-scripting-vulnerabilities-in-elementor-impact-over-7-million-sites/ - https://wpscan.com/vulnerability/772e172f-c8b4-4a6a-9eb9-9663295cfedf
CVE ID: CVE-2021-24205 State: PUBLISHED Published: 2021-04-05T18:27:46 Last Updated: 2024-08-03T19:21:18.691Z Vendors: Unknown Products: Elementor Website Builder Problem Types: CWE-79 Description: In the Elementor Website Builder WordPress plugin before 3.1.4, the icon box widget (includes/widgets/icon-box.php) accepts a ‘title_size’ parameter. Although the element control lists a fixed set of possible html tags, it is possible for a user with Contributor or above permissions to send a modified ‘save_builder’ request containing JavaScript in the ‘title_size’ parameter, which is not filtered and is output without escaping. This JavaScript will then be executed when the saved page is viewed o
ch is not filtered and is output without escaping. This JavaScript will then be executed when the saved page is viewed or previewed. Additional Analyst Notes: - CVE Program Container: References: - https://www.wordfence.com/blog/2021/03/cross-site-scripting-vulnerabilities-in-elementor-impact-over-7-million-sites/ - https://wpscan.com/vulnerability/ef23df6d-e265-44f6-bb94-1005b16d34d9
CVE ID: CVE-2021-24206 State: PUBLISHED Published: 2021-04-05T18:27:46 Last Updated: 2024-08-03T19:21:18.814Z Vendors: Unknown Products: Elementor Website Builder Problem Types: CWE-79 Description: In the Elementor Website Builder WordPress plugin before 3.1.4, the image box widget (includes/widgets/image-box.php) accepts a ‘title_size’ parameter. Although the element control lists a fixed set of possible html tags, it is possible for a user with Contributor or above permissions to send a modified ‘save_builder’ request containing JavaScript in the ‘title_size’ parameter, which is not filtered and is output without escaping. This JavaScript will then be executed when the saved page is viewed
hich is not filtered and is output without escaping. This JavaScript will then be executed when the saved page is viewed or previewed. Additional Analyst Notes: - CVE Program Container: References: - https://www.wordfence.com/blog/2021/03/cross-site-scripting-vulnerabilities-in-elementor-impact-over-7-million-sites/ - https://wpscan.com/vulnerability/2f66efd9-7d55-4f33-9109-3cb583a0c309
CVE ID: CVE-2021-24207 State: PUBLISHED Published: 2021-04-05T18:27:46 Last Updated: 2024-08-03T19:21:18.845Z Vendors: Unknown Products: WP Page Builder Problem Types: CWE-863 Description: By default, the WP Page Builder WordPress plugin before 1.2.4 allows subscriber-level users to edit and make changes to any and all posts pages - user roles must be specifically blocked from editing posts and pages. Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/21e7a46f-e9a3-4b20-b44a-a5b6ce7b7ce6 - https://www.themeum.com/wp-page-builder-updated-v1-2-4/
CVE ID: CVE-2021-24208 State: PUBLISHED Published: 2021-04-05T18:27:46 Last Updated: 2024-08-03T19:21:18.776Z Vendors: Unknown Products: WP Page Builder Problem Types: CWE-79 Description: The editor of the WP Page Builder WordPress plugin before 1.2.4 allows lower-privileged users to insert unfiltered HTML, including JavaScript, into pages via the “Raw HTML” widget and the “Custom HTML” widgets (though the custom HTML widget requires sending a crafted request - it appears that this widget uses some form of client side validation but not server side validation), all of which are added via the “page_builder_data” parameter when performing the “wppb_page_save” AJAX action. It is also possible t
are added via the “page_builder_data” parameter when performing the “wppb_page_save” AJAX action. It is also possible to insert malicious JavaScript via the “wppb_page_css” parameter (this can be done by closing out the style tag and opening a script tag) when performing the “wppb_page_save” AJAX action. Additional Analyst Notes: - CVE Program Container: References: - https://www.themeum.com/wp-page-builder-updated-v1-2-4/ - https://wpscan.com/vulnerability/c20e243d-b0de-4ae5-9a0d-b9d02c9b8141
CVE ID: CVE-2021-24209 State: PUBLISHED Published: 2021-04-05T18:27:46 Last Updated: 2024-08-03T19:21:18.735Z Vendors: Unknown Products: WP Super Cache Problem Types: CWE-94 Improper Control of Generation of Code ('Code Injection') Description: The WP Super Cache WordPress plugin before 1.7.2 was affected by an authenticated (admin+) RCE in the settings page due to input validation failure and weak $cache_path check in the WP Super Cache Settings -> Cache Location option. Direct access to the wp-cache-config.php file is not prohibited, so this vulnerability can be exploited for a web shell injection. Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerab
for a web shell injection. Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/733d8a02-0d44-4b78-bbb2-37e447acd2f3 - https://plugins.trac.wordpress.org/changeset/2496238/wp-super-cache
CVE ID: CVE-2021-24210 State: PUBLISHED Published: 2021-04-05T18:27:47 Last Updated: 2024-08-03T19:21:18.865Z Vendors: Unknown Products: PhastPress Problem Types: CWE-601 Description: There is an open redirect in the PhastPress WordPress plugin before 1.111 that allows an attacker to malform a request to a page with the plugin and then redirect the victim to a malicious page. There is also a support comment from another user one year ago (https://wordpress.org/support/topic/phast-php-used-for-remote-fetch/) that says that the php involved in the request only go to whitelisted pages but it's possible to redirect the victim to any domain. Additional Analyst Notes: - CVE Program Container: Refe
ed pages but it's possible to redirect the victim to any domain. Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/9b3c5412-8699-49e8-b60c-20d2085857fb - https://plugins.trac.wordpress.org/changeset/2497610/
CVE ID: CVE-2021-24211 State: PUBLISHED Published: 2021-04-05T18:27:47 Last Updated: 2024-08-03T19:21:18.808Z Vendors: Unknown Products: WordPress Related Posts Problem Types: CWE-79 Description: The WordPress Related Posts plugin through 3.6.4 contains an authenticated (admin+) stored XSS vulnerability in the title field on the settings page. By exploiting that an attacker will be able to execute JavaScript code in the user's browser. Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/37e0a033-3dee-476d-ae86-68354e8f0b1c
CVE ID: CVE-2021-24212 State: PUBLISHED Published: 2021-04-05T18:27:47 Last Updated: 2024-08-03T19:21:18.794Z Vendors: Unknown Products: WooCommerce Help Scout Problem Types: CWE-434 Description: The WooCommerce Help Scout WordPress plugin before 2.9.1 (https://woocommerce.com/products/woocommerce-help-scout/) allows unauthenticated users to upload any files to the site which by default will end up in wp-content/uploads/hstmp. Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/cf9305e8-f5bc-45c3-82db-0ef00fd46129 - http://dzv365zjfbd8v.cloudfront.net/changelogs/woocommerce-help-scout/changelog.txt
CVE ID: CVE-2021-24213 State: PUBLISHED Published: 2021-04-12T14:00:09 Last Updated: 2024-08-03T19:21:18.856Z Vendors: GiveWP Products: GiveWP – Donation Plugin and Fundraising Platform Problem Types: CWE-79 Description: The GiveWP – Donation Plugin and Fundraising Platform WordPress plugin before 2.10.0 was affected by a reflected Cross-Site Scripting vulnerability inside of the administration panel, via the 's' GET parameter on the Donors page. Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/da4ab508-a423-4c7f-a1d4-42ec6f989309 - https://bentl.ee/posts/cve-givewp/
CVE ID: CVE-2021-24214 State: PUBLISHED Published: 2021-05-05T18:39:42 Last Updated: 2024-08-03T19:21:18.670Z Vendors: daggerhart Products: OpenID Connect Generic Client Problem Types: CWE-79 Description: The OpenID Connect Generic Client WordPress plugin 3.8.0 and 3.8.1 did not sanitise the login error when output back in the login form, leading to a reflected Cross-Site Scripting issue. This issue does not require authentication and can be exploited with the default configuration. Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/31cf0dfb-4025-4898-a5f4-fc7115565a10
CVE ID: CVE-2021-24215 State: PUBLISHED Published: 2021-04-12T14:00:48 Last Updated: 2024-08-03T19:21:18.820Z Vendors: Unknown Products: Controlled Admin Access Problem Types: CWE-284 Description: An Improper Access Control vulnerability was discovered in the Controlled Admin Access WordPress plugin before 1.5.2. Uncontrolled access to the website customization functionality and global CMS settings, like /wp-admin/customization.php and /wp-admin/options.php, can lead to a complete compromise of the target resource. Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/eec0f29f-a985-4285-8eed-d1855d204a20 - https://m0ze.ru/vulnerability/%5B2021-03-1
es: - https://wpscan.com/vulnerability/eec0f29f-a985-4285-8eed-d1855d204a20 - https://m0ze.ru/vulnerability/%5B2021-03-18%5D-%5BWordPress%5D-%5BCWE-284%5D-Controlled-Admin-Access-WordPress-Plugin-v1.4.0.txt
CVE ID: CVE-2021-24216 State: PUBLISHED Published: 2022-03-07T08:15:55 Last Updated: 2024-08-03T19:21:18.671Z Vendors: Unknown Products: All-in-One WP Migration Problem Types: CWE-434 Description: The All-in-One WP Migration WordPress plugin before 7.41 does not validate uploaded files' extension, which allows administrators to upload PHP files on their site, even on multisite installations. Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/87c6052c-2628-4987-a9a3-a03b5ca1e083 - https://plugins.trac.wordpress.org/changeset/2516181#file8
CVE ID: CVE-2021-24217 State: PUBLISHED Published: 2021-04-12T14:01:19 Last Updated: 2024-08-03T19:21:18.798Z Vendors: Unknown Products: Facebook for WordPress Problem Types: CWE-502 Description: The run_action function of the Facebook for WordPress plugin before 3.0.0 deserializes user supplied data making it possible for PHP objects to be supplied creating an Object Injection vulnerability. There was also a useable magic method in the plugin that could be used to achieve remote code execution. Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/509f2754-a1a1-4142-9126-ae023a88533a - https://www.wordfence.com/blog/2021/03/two-vulnerabilities-pat
.com/vulnerability/509f2754-a1a1-4142-9126-ae023a88533a - https://www.wordfence.com/blog/2021/03/two-vulnerabilities-patched-in-facebook-for-wordpress-plugin/
CVE ID: CVE-2021-24218 State: PUBLISHED Published: 2021-04-12T14:01:34 Last Updated: 2024-08-03T19:21:18.784Z Vendors: Unknown Products: Facebook for WordPress Problem Types: CWE-352 Description: The wp_ajax_save_fbe_settings and wp_ajax_delete_fbe_settings AJAX actions of the Facebook for WordPress plugin before 3.0.4 were vulnerable to CSRF due to a lack of nonce protection. The settings in the saveFbeSettings function had no sanitization allowing for script tags to be saved. Additional Analyst Notes: - CVE Program Container: References: - https://www.wordfence.com/blog/2021/03/two-vulnerabilities-patched-in-facebook-for-wordpress-plugin/ - https://wpscan.com/vulnerability/169d21fc-d191-46
021/03/two-vulnerabilities-patched-in-facebook-for-wordpress-plugin/ - https://wpscan.com/vulnerability/169d21fc-d191-46ff-82e8-9ac887aed8a4
CVE ID: CVE-2021-24219 State: PUBLISHED Published: 2021-04-12T14:02:35 Last Updated: 2024-08-03T19:21:18.650Z Vendors: Thrive Themes Products: Thrive Optimize, Thrive Comments, Thrive Headline Optimizer, Thrive Leads, Thrive Ultimatum, Thrive Quiz Builder, Thrive Apprentice, Thrive Visual Editor, Thrive Dashboard, Thrive Ovation, Thrive Clever Widgets, Rise by Thrive Themes, Ignition by Thrive Themes, Luxe by Thrive Themes, FocusBlog by Thrive Themes, Minus by Thrive Themes, Squared by Thrive Themes, Voice, Performag by Thrive Themes, Pressive by Thrive Themes, Storied by Thrive Themes, Thrive Themes Builder Problem Types: CWE-284 Description: The Thrive Optimize WordPress plugin before 1.4.
hrive Themes, Thrive Themes Builder Problem Types: CWE-284 Description: The Thrive Optimize WordPress plugin before 1.4.13.3, Thrive Comments WordPress plugin before 1.4.15.3, Thrive Headline Optimizer WordPress plugin before 1.3.7.3, Thrive Leads WordPress plugin before 2.3.9.4, Thrive Ultimatum WordPress plugin before 2.3.9.4, Thrive Quiz Builder WordPress plugin before 2.3.9.4, Thrive Apprentice WordPress plugin before 2.3.9.4, Thrive Visual Editor WordPress plugin before 2.6.7.4, Thrive Dashboard WordPress plugin before 2.3.9.3, Thrive Ovation WordPress plugin before 2.4.5, Thrive Clever Widgets WordPress plugin before 1.57.1 and Rise by Thrive Themes WordPress theme before 2.0.0, Igniti
4.5, Thrive Clever Widgets WordPress plugin before 1.57.1 and Rise by Thrive Themes WordPress theme before 2.0.0, Ignition by Thrive Themes WordPress theme before 2.0.0, Luxe by Thrive Themes WordPress theme before 2.0.0, FocusBlog by Thrive Themes WordPress theme before 2.0.0, Minus by Thrive Themes WordPress theme before 2.0.0, Squared by Thrive Themes WordPress theme before 2.0.0, Voice WordPress theme before 2.0.0, Performag by Thrive Themes WordPress theme before 2.0.0, Pressive by Thrive Themes WordPress theme before 2.0.0, Storied by Thrive Themes WordPress theme before 2.0.0, Thrive Themes Builder WordPress theme before 2.2.4 register a REST API endpoint associated with Zapier functi
ore 2.0.0, Thrive Themes Builder WordPress theme before 2.2.4 register a REST API endpoint associated with Zapier functionality. While this endpoint was intended to require an API key in order to access, it was possible to access it by supplying an empty api_key parameter in vulnerable versions if Zapier was not enabled. Attackers could use this endpoint to add arbitrary data to a predefined option in the wp_options table. Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/35acd2d8-85fc-4af5-8f6c-224fa7d92900 - https://www.wordfence.com/blog/2021/03/recently-patched-vulnerability-in-thrive-themes-actively-exploited-in-the-wild
CVE ID: CVE-2021-24220 State: PUBLISHED Published: 2021-04-12T14:03:12 Last Updated: 2024-08-03T19:21:19.051Z Vendors: Thrive Themes Products: Rise by Thrive Themes, Luxe by Thrive Themes, Minus by Thrive Themes, Ignition by Thrive Themes, FocusBlog by Thrive Themes, Squared by Thrive Themes, Voice, Performag by Thrive Themes, Pressive by Thrive Themes, Storied by Thrive Themes Problem Types: CWE-434 Description: Thrive “Legacy” Rise by Thrive Themes WordPress theme before 2.0.0, Luxe by Thrive Themes WordPress theme before 2.0.0, Minus by Thrive Themes WordPress theme before 2.0.0, Ignition by Thrive Themes WordPress theme before 2.0.0, FocusBlog by Thrive Themes WordPress theme before 2.0.
re 2.0.0, Ignition by Thrive Themes WordPress theme before 2.0.0, FocusBlog by Thrive Themes WordPress theme before 2.0.0, Squared by Thrive Themes WordPress theme before 2.0.0, Voice WordPress theme before 2.0.0, Performag by Thrive Themes WordPress theme before 2.0.0, Pressive by Thrive Themes WordPress theme before 2.0.0, Storied by Thrive Themes WordPress theme before 2.0.0 register a REST API endpoint to compress images using the Kraken image optimization engine. By supplying a crafted request in combination with data inserted using the Option Update vulnerability, it was possible to use this endpoint to retrieve malicious code from a remote URL and overwrite an existing file on the sit
was possible to use this endpoint to retrieve malicious code from a remote URL and overwrite an existing file on the site with it or create a new file.This includes executable PHP files that contain malicious code. Additional Analyst Notes: - CVE Program Container: References: - https://www.wordfence.com/blog/2021/03/recently-patched-vulnerability-in-thrive-themes-actively-exploited-in-the-wild - https://wpscan.com/vulnerability/a2424354-2639-4f53-a24f-afc11f6c4cac
CVE ID: CVE-2021-24221 State: PUBLISHED Published: 2021-04-12T14:03:25 Last Updated: 2024-08-03T19:21:19.093Z Vendors: Unknown Products: Quiz And Survey Master – Best Quiz, Exam and Survey Plugin for WordPress Problem Types: CWE-89 Description: The Quiz And Survey Master – Best Quiz, Exam and Survey Plugin for WordPress plugin before 7.1.12 did not sanitise the result_id GET parameter on pages with the [qsm_result] shortcode without id attribute, concatenating it in a SQL statement and leading to an SQL injection. The lowest role allowed to use this shortcode in post or pages being author, such user could gain unauthorised access to the DBMS. If the shortcode (without the id attribute) is em
es being author, such user could gain unauthorised access to the DBMS. If the shortcode (without the id attribute) is embed on a public page or post, then unauthenticated users could exploit the injection. Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/3b52b25c-82a1-41c7-83ac-92e244f7c5ab - https://plugins.trac.wordpress.org/changeset/2479603/
CVE ID: CVE-2021-24222 State: PUBLISHED Published: 2021-04-12T14:03:34 Last Updated: 2024-08-03T19:21:18.724Z Vendors: Unknown Products: WP-Curriculo Vitae Free Problem Types: CWE-434 Description: The WP-Curriculo Vitae Free WordPress plugin through 6.3 suffers from an arbitrary file upload issue in page where the [formCadastro] is embed. The form allows unauthenticated user to register and submit files for their profile picture as well as resume, without any file extension restriction, leading to RCE. Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/4d715de6-8595-4da9-808a-04a28e409900 - https://github.com/jinhuang1102/CVE-ID-Reports/blob/145
/wpscan.com/vulnerability/4d715de6-8595-4da9-808a-04a28e409900 - https://github.com/jinhuang1102/CVE-ID-Reports/blob/145fc4e34c9b9799275c8e19d6b02f544c88126b/WP_Curriculo_Free.md
CVE ID: CVE-2021-24223 State: PUBLISHED Published: 2021-04-12T14:04:01 Last Updated: 2024-08-03T19:21:18.787Z Vendors: Unknown Products: N5 Upload Form Problem Types: CWE-434 Description: The N5 Upload Form WordPress plugin through 1.0 suffers from an arbitrary file upload issue in page where a Form from the plugin is embed, as any file can be uploaded. The uploaded filename might be hard to guess as it's generated with md5(uniqid(rand())), however, in the case of misconfigured servers with Directory listing enabled, accessing it is trivial. Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/d7a72183-0cd1-45de-b98b-2e295b27e5db - https://github.
Program Container: References: - https://wpscan.com/vulnerability/d7a72183-0cd1-45de-b98b-2e295b27e5db - https://github.com/jinhuang1102/CVE-ID-Reports/blob/12863f80ced5361e2e2c3f7209566ab3730aa37b/N5_upload.md
CVE ID: CVE-2021-24224 State: PUBLISHED Published: 2021-04-12T14:04:08 Last Updated: 2024-08-03T19:21:18.637Z Vendors: Unknown Products: Easy Form Builder Problem Types: CWE-434 Description: The EFBP_verify_upload_file AJAX action of the Easy Form Builder WordPress plugin through 1.0, available to authenticated users, does not have any security in place to verify uploaded files, allowing low privilege users to upload arbitrary files, leading to RCE. Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/ed0c054b-54bf-4df8-9015-c76704c93484 - https://github.com/jinhuang1102/CVE-ID-Reports/blob/e4c33529b20fa70e3a764ff9b1125839fb9900b5/Easy%20Form%20Bu
04c93484 - https://github.com/jinhuang1102/CVE-ID-Reports/blob/e4c33529b20fa70e3a764ff9b1125839fb9900b5/Easy%20Form%20Builder.md
CVE ID: CVE-2021-24225 State: PUBLISHED Published: 2021-04-12T14:04:37 Last Updated: 2024-08-03T19:21:18.700Z Vendors: Unknown Products: Advanced Booking Calendar Problem Types: CWE-79 Description: The Advanced Booking Calendar WordPress plugin before 1.6.7 did not sanitise the calId GET parameter in the "Seasons & Calendars" page before outputing it in an A tag, leading to a reflected XSS issue Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/25ca8af5-ab48-4e6d-b2ef-fc291742f1d5 - https://plugins.trac.wordpress.org/changeset/2503971/
CVE ID: CVE-2021-24226 State: PUBLISHED Published: 2021-04-12T14:04:46 Last Updated: 2024-08-03T19:21:18.651Z Vendors: Unknown Products: AccessAlly Problem Types: CWE-200 Description: In the AccessAlly WordPress plugin before 3.5.7, the file "resource/frontend/product/product-shortcode.php" responsible for the [accessally_order_form] shortcode is dumping serialize($_SERVER), which contains all environment variables. The leakage occurs on all public facing pages containing the [accessally_order_form] shortcode, no login or administrator role is required. Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/8e3e89fd-e380-4108-be23-00e87fbaad16
CVE ID: CVE-2021-24227 State: PUBLISHED Published: 2021-04-12T14:05:13 Last Updated: 2024-08-03T19:21:18.863Z Vendors: Unknown Products: Patreon WordPress Problem Types: CWE-200 Description: The Jetpack Scan team identified a Local File Disclosure vulnerability in the Patreon WordPress plugin before 1.7.0 that could be abused by anyone visiting the site. Using this attack vector, an attacker could leak important internal files like wp-config.php, which contains database credentials and cryptographic keys used in the generation of nonces and cookies. Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/f62df02d-7678-440f-84a1-ddbf09364016 - https:/
: - CVE Program Container: References: - https://wpscan.com/vulnerability/f62df02d-7678-440f-84a1-ddbf09364016 - https://jetpack.com/2021/03/26/vulnerabilities-found-in-patreon-wordpress-plugin/
CVE ID: CVE-2021-24228 State: PUBLISHED Published: 2021-04-12T14:05:35 Last Updated: 2024-08-03T19:21:19.050Z Vendors: Unknown Products: Patreon WordPress Problem Types: CWE-79 Description: The Jetpack Scan team identified a Reflected Cross-Site Scripting in the Login Form of the Patreon WordPress plugin before 1.7.2. The WordPress login form (wp-login.php) is hooked by the plugin and offers to allow users to authenticate on the site using their Patreon account. Unfortunately, some of the error logging logic behind the scene allowed user-controlled input to be reflected on the login page, unsanitized. Additional Analyst Notes: - CVE Program Container: References: - https://jetpack.com/2021/0