Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2021-24910 State: PUBLISHED Published: 2022-08-22T14:55:46 Last Updated: 2024-08-03T19:49:13.860Z Vendors: Unknown Products: Transposh WordPress Translation Problem Types: CWE-79 Description: The Transposh WordPress Translation WordPress plugin before 1.0.8 does not sanitise and escape the a parameter via an AJAX action (available to both unauthenticated and authenticated users when the curl library is installed) before outputting it back in the response, leading to a Reflected Cross-Site Scripting issue Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/b5cbebf4-5749-41a0-8be3-3333853fca17
CVE ID: CVE-2021-24911 State: PUBLISHED Published: 2022-08-22T14:56:13 Last Updated: 2024-08-03T19:49:14.019Z Vendors: Unknown Products: Transposh WordPress Translation Problem Types: CWE-79 Description: The Transposh WordPress Translation WordPress plugin before 1.0.8 does not sanitise and escape the tk0 parameter from the tp_translation AJAX action, leading to Stored Cross-Site Scripting, which will trigger in the admin dashboard of the plugin. The minimum role needed to perform such attack depends on the plugin "Who can translate ?" setting. Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/bd88be21-0cfc-46bd-b78a-23efc4868a55
CVE ID: CVE-2021-24912 State: PUBLISHED Published: 2022-08-22T14:56:37 Last Updated: 2024-08-03T19:49:13.475Z Vendors: Unknown Products: Transposh WordPress Translation Problem Types: CWE-352, CWE-79 Description: The Transposh WordPress Translation WordPress plugin before 1.0.8 does not have CSRF check in its tp_translation AJAX action, which could allow attackers to make authorised users add a translation. Given the lack of sanitisation in the tk0 parameter, this could lead to a Stored Cross-Site Scripting issue which will be executed in the context of a logged in admin Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/349483e2-3ab5-4573-bc03-
ditional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/349483e2-3ab5-4573-bc03-b1ebab40584d
CVE ID: CVE-2021-24913 State: PUBLISHED Published: 2022-02-28T09:06:20 Last Updated: 2024-08-03T19:49:14.408Z Vendors: Unknown Products: Logo Showcase with Slick Slider – Logo Carousel, Logo Slider & Logo Grid Problem Types: CWE-352 Description: The Logo Showcase with Slick Slider WordPress plugin before 2.0.1 does not have CSRF check in the lswss_save_attachment_data AJAX action, allowing attackers to make a logged in high privilege user, change title, description, alt text, and URL of arbitrary uploaded media. Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/2f499945-1924-49f0-ad6e-9192273a5c05 - https://plugins.trac.wordpress.org/changeset/
- https://wpscan.com/vulnerability/2f499945-1924-49f0-ad6e-9192273a5c05 - https://plugins.trac.wordpress.org/changeset/2669404
CVE ID: CVE-2021-24914 State: PUBLISHED Published: 2021-12-06T15:55:28 Last Updated: 2024-08-03T19:49:13.922Z Vendors: Unknown Products: Tawk.To Live Chat Problem Types: CWE-862 Description: The Tawk.To Live Chat WordPress plugin before 0.6.0 does not have capability and CSRF checks in the tawkto_setwidget and tawkto_removewidget AJAX actions, available to any authenticated user. The first one allows low-privileged users (including simple subscribers) to change the 'tawkto-embed-widget-page-id' and 'tawkto-embed-widget-widget-id' parameters. Any authenticated user can thus link the vulnerable website to their own Tawk.to instance. Consequently, they will be able to monitor the vulnerable web
link the vulnerable website to their own Tawk.to instance. Consequently, they will be able to monitor the vulnerable website and interact with its visitors (receive contact messages, answer, ...). They will also be able to display an arbitrary Knowledge Base. The second one will remove the live chat widget from pages. Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/39392055-8cd3-452f-8bcb-a650f5bddc2e
CVE ID: CVE-2021-24915 State: PUBLISHED Published: 2021-11-29T08:25:50 Last Updated: 2024-08-03T19:49:13.959Z Vendors: Unknown Products: Contest Gallery – Photo Contest Plugin for WordPress Problem Types: CWE-89 Description: The Contest Gallery WordPress plugin before 13.1.0.6 does not have capability checks and does not sanitise or escape the cg-search-user-name-original parameter before using it in a SQL statement when exporting users from a gallery, which could allow unauthenticated to perform SQL injections attacks, as well as get the list of all users registered on the blog, including their username and email address Additional Analyst Notes: - CVE Program Container: References: - https
blog, including their username and email address Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/45ee86a7-1497-4c81-98b8-9a8e5b3d4fac - https://gist.github.com/tpmiller87/6c05596fe27dd6f69f1aaba4cbb9c917
CVE ID: CVE-2021-24916 State: PUBLISHED Published: 2023-08-07T14:31:23.983Z Last Updated: 2024-10-15T18:12:07.814Z Vendors: Unknown Products: Qubely Problem Types: CWE-284 Improper Access Control Description: The Qubely WordPress plugin before 1.8.6 allows unauthenticated user to send arbitrary e-mails to arbitrary addresses via the qubely_send_form_data AJAX action. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/93b893be-59ad-4500-8edb-9fa7a45304d5
CVE ID: CVE-2021-24917 State: PUBLISHED Published: 2021-12-06T15:55:30 Last Updated: 2024-08-03T19:49:13.491Z Vendors: Unknown Products: WPS Hide Login Problem Types: CWE-863 Description: The WPS Hide Login WordPress plugin before 1.9.1 has a bug which allows to get the secret login page by setting a random referer string and making a request to /wp-admin/options.php as an unauthenticated user. Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/15bb711a-7d70-4891-b7a2-c473e3e8b375 - https://wordpress.org/support/topic/bypass-security-issue/
CVE ID: CVE-2021-24918 State: PUBLISHED Published: 2021-11-29T08:25:51 Last Updated: 2024-08-03T19:49:13.472Z Vendors: Unknown Products: Smash Balloon Social Post Feed Problem Types: CWE-79 Description: The Smash Balloon Social Post Feed WordPress plugin before 4.0.1 did not have any privilege or nonce validation before saving the plugin's setting. As a result, any logged-in user on a vulnerable site could update the settings and store rogue JavaScript on each of its posts and pages. Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/5d252ad7-bf28-44f3-8cd0-c4fe05c48f35 - https://jetpack.com/2021/10/29/security-issues-patched-in-smash-balloon-so
bility/5d252ad7-bf28-44f3-8cd0-c4fe05c48f35 - https://jetpack.com/2021/10/29/security-issues-patched-in-smash-balloon-social-post-feed-plugin/
CVE ID: CVE-2021-24919 State: PUBLISHED Published: 2022-02-01T12:21:30 Last Updated: 2024-08-03T19:49:13.949Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Wicked Folders WordPress plugin before 2.8.10 does not sanitise and escape the folder_id parameter before using it in a SQL statement in the wicked_folders_save_sort_order AJAX action, available to any authenticated user. leading to an SQL injection Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/f472ec7d-765c-4266-ab9c-e2d06703ebb4 - https://plugins.trac.wordpress.org/changeset/2651221
CVE ID: CVE-2021-24920 State: PUBLISHED Published: 2022-02-28T09:06:21 Last Updated: 2024-08-03T19:49:14.031Z Vendors: Unknown Products: StatCounter – Free Real Time Visitor Stats Problem Types: CWE-79 Description: The StatCounter WordPress plugin before 2.0.7 does not sanitise and escape the Project ID and Secure Code settings, which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/b00b5037-8ce4-4f61-b2ce-33315b39454e - https://plugins.trac.wordpress.org/changeset/2664933
CVE ID: CVE-2021-24921 State: PUBLISHED Published: 2022-02-21T10:45:41 Last Updated: 2024-08-03T19:49:13.923Z Vendors: Unknown Products: Advanced Database Cleaner Problem Types: CWE-79 Description: The Advanced Database Cleaner WordPress plugin before 3.0.4 does not sanitise and escape $_GET keys and values before outputting them back in attributes, leading to Reflected Cross-Site Scripting issues Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/43ab0997-4d15-4ff7-af41-7b528b0ba3c7
CVE ID: CVE-2021-24922 State: PUBLISHED Published: 2021-12-13T10:41:19 Last Updated: 2024-08-03T19:49:13.810Z Vendors: Unknown Products: Pixel Cat – Conversion Pixel Manager Problem Types: CWE-352 Description: The Pixel Cat WordPress plugin before 2.6.2 does not have CSRF check when saving its settings, and did not sanitise as well as escape some of them, which could allow attacker to make a logged in admin change them and perform Cross-Site Scripting attacks Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/399ffd65-f3c0-4fbe-a83a-2a620976aad2
CVE ID: CVE-2021-24923 State: PUBLISHED Published: 2022-01-24T08:00:55 Last Updated: 2024-08-03T19:49:13.481Z Vendors: Unknown Products: Newsletter, SMTP, Email marketing and Subscribe forms by Sendinblue Problem Types: CWE-79 Description: The Newsletter, SMTP, Email marketing and Subscribe forms by Sendinblue WordPress plugin before 3.1.25 does not escape the sib-statistics-date parameter before outputting it back in an attribute, leading to a Reflected Cross-Site Scripting issue Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/3afef591-9e00-4af8-a8a6-e04ec5e61795
CVE ID: CVE-2021-24924 State: PUBLISHED Published: 2021-12-06T15:55:31 Last Updated: 2024-08-03T19:49:13.481Z Vendors: Unknown Products: Email Log Problem Types: CWE-79 Description: The Email Log WordPress plugin before 2.4.8 does not escape the d parameter before outputting it back in an attribute in the Log page, leading to a Reflected Cross-Site Scripting issue Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/4621e86e-aba4-429c-8e08-32cf9b4c65e6
CVE ID: CVE-2021-24925 State: PUBLISHED Published: 2021-12-13T10:41:20 Last Updated: 2024-08-03T19:49:14.007Z Vendors: Unknown Products: Modern Events Calendar Lite Problem Types: CWE-79 Description: The Modern Events Calendar Lite WordPress plugin before 6.1.5 does not sanitise and escape the current_month_divider parameter of its mec_list_load_more AJAX call (available to both unauthenticated and authenticated users) before outputting it back in the response, leading to a Reflected Cross-Site Scripting issue Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/82233588-6033-462d-b886-a8ef5ee9adb0
CVE ID: CVE-2021-24926 State: PUBLISHED Published: 2022-02-01T12:21:30 Last Updated: 2024-08-03T19:49:14.026Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Domain Check WordPress plugin before 1.0.17 does not sanitise and escape the domain parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting issue Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/8cc7cbbd-f74f-4f30-9483-573641fea733
CVE ID: CVE-2021-24927 State: PUBLISHED Published: 2021-11-29T08:25:52 Last Updated: 2024-08-03T19:49:12.670Z Vendors: Unknown Products: My Calendar Problem Types: CWE-79 Description: The My Calendar WordPress plugin before 3.2.18 does not sanitise and escape the callback parameter of the mc_post_lookup AJAX action (available to any authenticated user) before outputting it back in the response, leading to a Reflected Cross-Site Scripting issue Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/86f3acc7-8902-4215-bd75-6105d601524e
CVE ID: CVE-2021-24928 State: PUBLISHED Published: 2022-02-07T15:47:13 Last Updated: 2024-08-03T19:49:14.008Z Vendors: Unknown Products: Rearrange Woocommerce Products Problem Types: CWE-89 Description: The Rearrange Woocommerce Products WordPress plugin before 3.0.8 does not have proper access controls in the save_all_order AJAX action, nor validation and escaping when inserting user data in SQL statement, leading to an SQL injection, and allowing any authenticated user, such as subscriber, to modify arbitrary post content (for example with an XSS payload), as well as exfiltrate any data by copying it to another post. Additional Analyst Notes: - CVE Program Container: References: - https://
ltrate any data by copying it to another post. Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/3762a77c-b8c9-428f-877c-bbfd7958e7be
CVE ID: CVE-2021-24930 State: PUBLISHED Published: 2021-12-06T15:55:32 Last Updated: 2024-08-03T19:49:14.020Z Vendors: Unknown Products: WordPress Online Booking and Scheduling Plugin – Bookly Problem Types: CWE-79 Description: The WordPress Online Booking and Scheduling Plugin WordPress plugin before 20.3.1 does not escape the Staff Full Name field before outputting it back in a page, which could lead to a Stored Cross-Site Scripting issue Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/479704d8-057b-4642-b84a-4a78567ba20b
CVE ID: CVE-2021-24931 State: PUBLISHED Published: 2021-12-06T15:55:34 Last Updated: 2024-08-03T19:49:14.241Z Vendors: Unknown Products: Secure Copy Content Protection and Content Locking Problem Types: CWE-89 Description: The Secure Copy Content Protection and Content Locking WordPress plugin before 2.8.2 does not escape the sccp_id parameter of the ays_sccp_results_export_file AJAX action (available to both unauthenticated and authenticated users) before using it in a SQL statement, leading to an SQL injection. Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/1cd52d61-af75-43ed-9b99-b46c471c4231 - http://packetstormsecurity.com/files/165946/
: - https://wpscan.com/vulnerability/1cd52d61-af75-43ed-9b99-b46c471c4231 - http://packetstormsecurity.com/files/165946/WordPress-Secure-Copy-Content-Protection-And-Content-Locking-2.8.1-SQL-Injection.html
CVE ID: CVE-2021-24932 State: PUBLISHED Published: 2021-12-13T10:41:22 Last Updated: 2024-08-03T19:49:12.678Z Vendors: Unknown Products: Auto Featured Image (Auto Post Thumbnail) Problem Types: CWE-79 Description: The Auto Featured Image (Auto Post Thumbnail) WordPress plugin before 3.9.3 does not sanitise and escape the post_id parameter before outputting back in an admin page within a JS block, leading to a Reflected Cross-Site Scripting issue. Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/575c02ea-4fe9-428c-bbc8-e161af679b6d
CVE ID: CVE-2021-24933 State: PUBLISHED Published: 2022-02-28T09:06:23 Last Updated: 2024-08-03T19:49:13.872Z Vendors: Unknown Products: Dynamic Widgets Problem Types: CWE-79 Description: The Dynamic Widgets WordPress plugin through 1.5.16 does not escape the prefix parameter before outputting it back in an attribute when using the term_tree AJAX action (available to any authenticated users), leading to a Reflected Cross-Site Scripting issue Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/b8e6f0d3-a7d1-4ca8-aba8-0d5075167d55
CVE ID: CVE-2021-24934 State: PUBLISHED Published: 2022-02-01T12:21:31 Last Updated: 2024-08-03T19:49:14.011Z Vendors: Unknown Products: Visual CSS Style Editor Problem Types: CWE-79 Description: The Visual CSS Style Editor WordPress plugin before 7.5.4 does not sanitise and escape the wyp_page_type parameter before outputting it back in an admin page, leading to a Reflected Cross-Site Scripting issue Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/0aa5a8d5-e736-4cd3-abfd-8e0a356bb6ef - https://plugins.trac.wordpress.org/changeset/2649978
CVE ID: CVE-2021-24935 State: PUBLISHED Published: 2021-12-06T15:55:35 Last Updated: 2024-08-03T19:49:13.517Z Vendors: Unknown Products: WP Google Fonts Problem Types: CWE-79 Description: The WP Google Fonts WordPress plugin before 3.1.5 does not escape the googlefont_ajax_name and googlefont_ajax_family parameter of the googlefont_action AJAx action (available to any authenticated user) before outputing them in attributes, leading Reflected Cross-Site Scripting issues Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/53702281-1bd5-4828-b7a4-9f81cf0b6bb6 - https://plugins.trac.wordpress.org/changeset/2623659
CVE ID: CVE-2021-24936 State: PUBLISHED Published: 2022-01-24T08:00:56 Last Updated: 2024-08-03T19:49:13.407Z Vendors: Unknown Products: WP Extra File Types Problem Types: CWE-352 Description: The WP Extra File Types WordPress plugin before 0.5.1 does not have CSRF check when saving its settings, nor sanitise and escape some of them, which could allow attackers to make a logged in admin change them and perform Cross-Site Scripting attacks Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/4fb61b84-ff5f-4b4c-a516-54b749f9611e
CVE ID: CVE-2021-24937 State: PUBLISHED Published: 2022-02-01T12:21:32 Last Updated: 2024-08-03T19:49:13.474Z Vendors: Unknown Products: Asset CleanUp: Page Speed Booster Problem Types: CWE-79 Description: The Asset CleanUp: Page Speed Booster WordPress plugin before 1.3.8.5 does not escape the wpacu_selected_sub_tab_area parameter before outputting it back in an attribute in an admin page, leading to a Reflected Cross-Site Scripting issue Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/dde3c119-dad9-4205-a931-d49bbf3b6b87
CVE ID: CVE-2021-24938 State: PUBLISHED Published: 2021-12-06T15:55:37 Last Updated: 2024-08-03T19:49:13.917Z Vendors: Unknown Products: WOOCS – Currency Switcher for WooCommerce. Professional and Free multi currency plugin – Pay in selected currency Problem Types: CWE-79 Description: The WOOCS WordPress plugin before 1.3.7.1 does not sanitise and escape the key parameter of the woocs_update_profiles_data AJAX action (available to any authenticated user) before outputting it back in the response, leading to a Reflected cross-Site Scripting issue Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/df8a6f2c-e075-45d5-9262-b4eb63c9351e
CVE ID: CVE-2021-24939 State: PUBLISHED Published: 2021-12-06T15:55:38 Last Updated: 2024-08-03T19:49:13.832Z Vendors: Unknown Products: LoginWP (Formerly Peter's Login Redirect) Problem Types: CWE-79 Description: The LoginWP (Formerly Peter's Login Redirect) WordPress plugin before 3.0.0.5 does not sanitise and escape the rul_login_url and rul_logout_url parameter before outputting them back in attributes in an admin page, leading to a Reflected Cross-Site Scripting issue Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/1a46cfec-24ad-4619-8579-f09bbd8ee748
CVE ID: CVE-2021-24940 State: PUBLISHED Published: 2022-03-14T14:40:59 Last Updated: 2024-08-03T19:49:14.052Z Vendors: Unknown Products: ووکامرس فارسی Problem Types: CWE-79 Description: The Persian Woocommerce WordPress plugin through 5.8.0 does not escape the s parameter before outputting it back in an attribute in the admin dashboard, which could lead to a Reflected Cross-Site Scripting issue Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/1980c5ca-447d-4875-b542-9212cc7ff77f
CVE ID: CVE-2021-24941 State: PUBLISHED Published: 2021-12-21T08:45:37 Last Updated: 2024-08-03T19:49:13.877Z Vendors: Unknown Products: Popups, Welcome Bar, Optins and Lead Generation Plugin – Icegram Problem Types: CWE-79 Description: The Popups, Welcome Bar, Optins and Lead Generation Plugin WordPress plugin before 2.0.5 does not sanitise and escape the message_id parameter of the get_message_action_row AJAX action before outputting it back in an attribute, leading to a reflected Cross-Site Scripting issue Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/beca7afd-8f03-4909-bea0-77b63513564b
CVE ID: CVE-2021-24942 State: PUBLISHED Published: 2022-12-26T12:28:21.456Z Last Updated: 2025-04-14T13:01:26.113Z Vendors: Unknown Products: Menu Item Visibility Control Problem Types: CWE-94 Improper Control of Generation of Code ('Code Injection') Description: The Menu Item Visibility Control WordPress plugin through 0.5 doesn't sanitize and validate the "Visibility logic" option for WordPress menu items, which could allow highly privileged users to execute arbitrary PHP code even in a hardened environment. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/eaa28832-74c1-4cd5-9b0f-02338e23b418
CVE ID: CVE-2021-24943 State: PUBLISHED Published: 2021-12-06T15:55:39 Last Updated: 2024-08-03T19:49:13.882Z Vendors: Unknown Products: Registrations for the Events Calendar – Event Registration Plugin Problem Types: CWE-89 Description: The Registrations for the Events Calendar WordPress plugin before 2.7.6 does not sanitise and escape the event_id in the rtec_send_unregister_link AJAX action (available to both unauthenticated and authenticated users) before using it in a SQL statement, leading to an unauthenticated SQL injection. Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/ba50c590-42ee-4523-8aa0-87ac644b77ed
CVE ID: CVE-2021-24944 State: PUBLISHED Published: 2022-02-01T12:21:33 Last Updated: 2024-08-03T19:49:13.514Z Vendors: Unknown Products: Custom Dashboard & Login Page – AGCA Problem Types: CWE-79 Description: The Custom Dashboard & Login Page WordPress plugin before 7.0 does not sanitise some of its settings, allowing high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed. Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/d1bfdce3-89bd-441f-8ebb-02cf0ff8b6cc
CVE ID: CVE-2021-24945 State: PUBLISHED Published: 2021-12-13T10:41:23 Last Updated: 2024-08-03T19:49:14.290Z Vendors: Unknown Products: Like Button Rating ♥ LikeBtn Problem Types: CWE-200 Description: The Like Button Rating ♥ LikeBtn WordPress plugin before 2.6.38 does not have any authorisation and CSRF checks in the likebtn_export_votes AJAX action, which could allow any authenticated user, such as subscriber, to get a list of email and IP addresses of people who liked content from the blog. Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/d7618061-a7fa-4da4-9384-be19bc5e8548
CVE ID: CVE-2021-24946 State: PUBLISHED Published: 2021-12-13T10:41:25 Last Updated: 2024-08-03T19:49:14.085Z Vendors: Unknown Products: Modern Events Calendar Lite Problem Types: CWE-89 Description: The Modern Events Calendar Lite WordPress plugin before 6.1.5 does not sanitise and escape the time parameter before using it in a SQL statement in the mec_load_single_page AJAX action, available to unauthenticated users, leading to an unauthenticated SQL injection issue Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/09871847-1d6a-4dfe-8a8c-f2f53ff87445 - http://packetstormsecurity.com/files/165742/WordPress-Modern-Events-Calendar-6.1-SQL-Inject
d6a-4dfe-8a8c-f2f53ff87445 - http://packetstormsecurity.com/files/165742/WordPress-Modern-Events-Calendar-6.1-SQL-Injection.html - https://github.com/Hacker5preme/Exploits/tree/main/Wordpress/CVE-2021-24946