Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
XSS payload can be triggered either in the backend only (in the plugin's settings), or both frontend and backend. Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/351de889-9c0a-4637-bd06-0e1fe1d7e89f
CVE ID: CVE-2021-24536 State: PUBLISHED Published: 2021-08-16T10:48:30 Last Updated: 2024-08-03T19:35:19.891Z Vendors: Unknown Products: Custom Login Redirect Problem Types: CWE-79, CWE-352 Description: The Custom Login Redirect WordPress plugin through 1.0.0 does not have CSRF check in place when saving its settings, and do not sanitise or escape user input before outputting them back in the page, leading to a Stored Cross-Site Scripting issue Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/e1ca9978-a44d-4717-b963-acaf56258fc9
CVE ID: CVE-2021-24537 State: PUBLISHED Published: 2021-11-08T17:34:43 Last Updated: 2024-08-03T19:35:20.024Z Vendors: Unknown Products: Similar Posts – Best Related Posts Plugin for WordPress Problem Types: CWE-94 Description: The Similar Posts WordPress plugin through 3.1.5 allow high privilege users to execute arbitrary PHP code in an hardened environment (ie with DISALLOW_FILE_EDIT, DISALLOW_FILE_MODS and DISALLOW_UNFILTERED_HTML set to true) via the 'widget_rrm_similar_posts_condition' widget setting of the plugin. Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/0d6b46cb-5244-486f-ad70-4023907ac9eb
CVE ID: CVE-2021-24538 State: PUBLISHED Published: 2021-08-16T10:48:31 Last Updated: 2024-08-03T19:35:20.035Z Vendors: Unknown Products: Current Book Problem Types: CWE-79 Description: The Current Book WordPress plugin through 1.0.1 does not sanitize user input when an authenticated user adds Author or Book Title, then does not escape these values when outputting to the browser leading to an Authenticated Stored XSS Cross-Site Scripting issue. Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/f9911a43-0f4c-403f-9fca-7822eb693317
CVE ID: CVE-2021-24539 State: PUBLISHED Published: 2021-11-01T08:45:58 Last Updated: 2024-08-03T19:35:19.989Z Vendors: Unknown Products: Coming Soon, Under Construction & Maintenance Mode By Dazzler Problem Types: CWE-79 Description: The Coming Soon, Under Construction & Maintenance Mode By Dazzler WordPress plugin before 1.6.7 does not sanitise or escape its description setting when outputting it in the frontend when the Coming Soon mode is enabled, even when the unfiltered_html capability is disallowed, leading to an authenticated Stored Cross-Site Scripting issue Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/4bda5dff-f577-4cd8-a225-c6b4c
nal Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/4bda5dff-f577-4cd8-a225-c6b4c32f22b4
CVE ID: CVE-2021-24540 State: PUBLISHED Published: 2021-08-16T10:48:31 Last Updated: 2024-08-03T19:35:19.842Z Vendors: Unknown Products: Wonder Video Embed Problem Types: CWE-79 Description: The Wonder Video Embed WordPress plugin before 1.8 does not escape parameters of its wonderplugin_video shortcode, which could allow users with a role as low as Contributor to perform Stored XSS attacks. Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/67910e5d-ea93-418b-af81-c50d0e05d213
CVE ID: CVE-2021-24541 State: PUBLISHED Published: 2021-08-16T10:48:32 Last Updated: 2024-08-03T19:35:20.103Z Vendors: Unknown Products: Wonder PDF Embed Problem Types: CWE-79 Description: The Wonder PDF Embed WordPress plugin before 1.7 does not escape parameters of its wonderplugin_pdf shortcode, which could allow users with a role as low as Contributor to perform Stored XSS attacks. Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/e6602369-87f4-4454-8298-89cc69f8375c
CVE ID: CVE-2021-24543 State: PUBLISHED Published: 2021-10-25T13:20:42 Last Updated: 2024-08-03T19:35:19.976Z Vendors: Unknown Products: jQuery Reply to Comment Problem Types: CWE-352, CWE-79 Description: The jQuery Reply to Comment WordPress plugin through 1.31 does not have any CSRF check when saving its settings, nor sanitise or escape its 'Quote String' and 'Reply String' settings before outputting them in Comments, leading to a Stored Cross-Site Scripting issue. Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/aa23f743-811b-4fd1-81a9-42916342e312
CVE ID: CVE-2021-24544 State: PUBLISHED Published: 2021-10-25T13:20:44 Last Updated: 2024-08-03T19:35:20.162Z Vendors: Unknown Products: Responsive WordPress Slider Problem Types: CWE-79 Description: The Responsive WordPress Slider WordPress plugin through 2.2.0 does not sanitise and escape some of the Slider options, allowing Cross-Site Scripting payloads to be set in them. Furthermore, as by default any authenticated user is allowed to create Sliders (https://wordpress.org/support/topic/slider-can-be-changed-from-any-user-even-subscriber/, such settings can be changed in the plugin's settings), this would allow user with a role as low as subscriber to perform Cross-Site Scripting attacks a
the plugin's settings), this would allow user with a role as low as subscriber to perform Cross-Site Scripting attacks against logged in admins viewing the slider list and could lead to privilege escalation by creating a rogue admin account for example. Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/4a2dddfc-6ce2-4edd-aaaa-4c130a9356d0
CVE ID: CVE-2021-24545 State: PUBLISHED Published: 2021-10-11T10:45:27 Last Updated: 2024-08-03T19:35:20.073Z Vendors: Unknown Products: WP HTML Author Bio Problem Types: CWE-79 Description: The WP HTML Author Bio WordPress plugin through 1.2.0 does not sanitise the HTML allowed in the Bio of users, allowing them to use malicious JavaScript code, which will be executed when anyone visit a post in the frontend made by such user. As a result, user with a role as low as author could perform Cross-Site Scripting attacks against users, which could potentially lead to privilege escalation when an admin view the related post/s. Additional Analyst Notes: - CVE Program Container: References: - https:
scalation when an admin view the related post/s. Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/64267134-9d8c-4e0c-b24f-d18692a5775e
CVE ID: CVE-2021-24546 State: PUBLISHED Published: 2021-10-11T10:45:29 Last Updated: 2024-08-03T19:35:20.035Z Vendors: Unknown Products: Gutenberg Block Editor Toolkit – EditorsKit Problem Types: CWE-94 Description: The Gutenberg Block Editor Toolkit – EditorsKit WordPress plugin before 1.31.6 does not sanitise and validate the Conditional Logic of the Custom Visibility settings, allowing users with a role as low contributor to execute Arbitrary PHP code Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/bdc36f6a-682d-4d66-b587-92e86085d971
CVE ID: CVE-2021-24547 State: PUBLISHED Published: 2021-08-23T11:10:02 Last Updated: 2024-08-03T19:35:20.141Z Vendors: Unknown Products: KN Fix Your Title Problem Types: CWE-79 Description: The KN Fix Your Title WordPress plugin through 1.0.1 was vulnerable to Authenticated Stored XSS in the separator field. Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/faaeb685-ea02-4a5a-ac5f-87081efe94e0
CVE ID: CVE-2021-24548 State: PUBLISHED Published: 2021-08-16T10:48:33 Last Updated: 2024-08-03T19:35:20.155Z Vendors: Unknown Products: Mimetic Books Problem Types: CWE-79 Description: The Mimetic Books WordPress plugin through 0.2.13 was vulnerable to Authenticated Stored Cross-Site Scripting (XSS) in the "Default Publisher ID" field on the plugin's settings page. Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/10660c95-d366-4152-9ce8-b57c57a2ec6c
CVE ID: CVE-2021-24549 State: PUBLISHED Published: 2021-08-23T11:10:03 Last Updated: 2024-08-03T19:35:20.123Z Vendors: Unknown Products: AceIDE Problem Types: CWE-22 Description: The AceIDE WordPress plugin through 2.6.2 does not sanitise or validate the user input which is appended to system paths before using it in various actions, such as to read arbitrary files from the server. This allows high privilege users such as administrator to access any file on the web server outside of the blog directory via a path traversal attack. Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/c594abaf-b152-448c-8a20-9b3267fe547a - https://codevigilant.com/di
ainer: References: - https://wpscan.com/vulnerability/c594abaf-b152-448c-8a20-9b3267fe547a - https://codevigilant.com/disclosure/2021/wp-plugin-aceide/
CVE ID: CVE-2021-24550 State: PUBLISHED Published: 2021-08-23T11:10:04 Last Updated: 2024-08-03T19:35:20.125Z Vendors: Unknown Products: Broken Link Manager Problem Types: CWE-89 Description: The Broken Link Manager WordPress plugin through 0.6.5 does not sanitise, validate or escape the url GET parameter before using it in a SQL statement when retrieving an URL to edit, leading to an authenticated SQL injection issue Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/1bf65448-689c-474d-a566-c9b6797d3e4a - https://codevigilant.com/disclosure/2021/wp-plugin-broken-link-manager/
CVE ID: CVE-2021-24551 State: PUBLISHED Published: 2021-08-23T11:10:06 Last Updated: 2024-08-03T19:35:19.902Z Vendors: Unknown Products: Edit Comments Problem Types: CWE-89 Description: The Edit Comments WordPress plugin through 0.3 does not sanitise, validate or escape the jal_edit_comments GET parameter before using it in a SQL statement, leading to a SQL injection issue Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/e62fb8db-384f-4384-ad24-e10eb9058ed5 - https://codevigilant.com/disclosure/2021/wp-plugin-edit-comments/
CVE ID: CVE-2021-24552 State: PUBLISHED Published: 2021-08-23T11:10:07 Last Updated: 2024-08-03T19:35:20.202Z Vendors: Unknown Products: Simple Events Calendar Problem Types: CWE-89 Description: The Simple Events Calendar WordPress plugin through 1.4.0 does not sanitise, validate or escape the event_id POST parameter before using it in a SQL statement when deleting events, leading to an authenticated SQL injection issue Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/3482a015-a5ed-4913-b516-9eae2b3f89db - https://codevigilant.com/disclosure/2021/wp-plugin-simple-events-calendar/
CVE ID: CVE-2021-24553 State: PUBLISHED Published: 2021-08-23T11:10:08 Last Updated: 2024-08-03T19:35:20.133Z Vendors: Unknown Products: Timeline Calendar Problem Types: CWE-89 Description: The Timeline Calendar WordPress plugin through 1.2 does not sanitise, validate or escape the edit GET parameter before using it in a SQL statement when editing events, leading to an authenticated SQL injection issue. Other SQL Injections are also present in the plugin Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/14c75a00-a52b-430b-92da-5145e5aee30a - https://codevigilant.com/disclosure/2021/wp-plugin-timeline-calendar/
CVE ID: CVE-2021-24554 State: PUBLISHED Published: 2021-08-23T11:10:09 Last Updated: 2024-08-03T19:35:20.133Z Vendors: Unknown Products: Paytm – Donation Plugin Problem Types: CWE-89 Description: The Paytm – Donation Plugin WordPress plugin through 1.3.2 does not sanitise, validate or escape the id GET parameter before using it in a SQL statement when deleting donations, leading to an authenticated SQL injection issue Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/f2842ac8-76fa-4490-aa0c-5f2b07ecf2ad - https://codevigilant.com/disclosure/2021/wp-plugin-wp-paytm-pay/
CVE ID: CVE-2021-24555 State: PUBLISHED Published: 2021-08-23T11:10:09 Last Updated: 2024-08-03T19:35:20.187Z Vendors: Unknown Products: Diary & Availability Calendar Problem Types: CWE-89, CWE-352 Description: The daac_delete_booking_callback function, hooked to the daac_delete_booking AJAX action, takes the id POST parameter which is passed into the SQL statement without proper sanitisation, validation or escaping, leading to a SQL Injection issue. Furthermore, the ajax action is lacking any CSRF and capability check, making it available to any authenticated user. Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/8eafd84b-6214-450b-869b-0afe7
nal Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/8eafd84b-6214-450b-869b-0afe7cca4c5f - https://codevigilant.com/disclosure/2021/wp-plugin-diary-availability-calendar/
CVE ID: CVE-2021-24556 State: PUBLISHED Published: 2021-08-23T11:10:10 Last Updated: 2024-08-03T19:35:20.064Z Vendors: Unknown Products: Email Subscriber Problem Types: CWE-79 Description: The kento_email_subscriber_ajax AJAX action of the Email Subscriber WordPress plugin through 1.1, does not properly sanitise, validate and escape the submitted subscribe_email and subscribe_name POST parameters, inserting them in the DB and then outputting them back in the Subscriber list (/wp-admin/edit.php?post_type=kes_campaign&page=kento_email_subscriber_list_settings), leading a Stored XSS issue. Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/f050aedc
ed XSS issue. Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/f050aedc-f79f-4b27-acac-0cdb33b25af8 - https://codevigilant.com/disclosure/2021/wp-plugin-email-subscriber/
CVE ID: CVE-2021-24557 State: PUBLISHED Published: 2021-08-23T11:10:11 Last Updated: 2024-08-03T19:35:20.133Z Vendors: Unknown Products: M-vSlider Problem Types: CWE-89 Description: The update functionality in the rslider_page uses an rs_id POST parameter which is not validated, sanitised or escaped before being inserted in sql query, therefore leading to SQL injection for users having Administrator role. Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/8b8e41e8-5a40-4062-b5b7-3b01b1a709ef - https://codevigilant.com/disclosure/2021/wp-plugin-m-vslider/
CVE ID: CVE-2021-24558 State: PUBLISHED Published: 2021-08-23T11:10:12 Last Updated: 2024-08-03T19:35:20.186Z Vendors: Unknown Products: Project Status Problem Types: CWE-79 Description: The pspin_duplicate_post_save_as_new_post function of the Project Status WordPress plugin through 1.6 does not sanitise, validate or escape the post GET parameter passed to it before outputting it in an error message when the related post does not exist, leading to a reflected XSS issue Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/ca5f2152-fcfd-492d-a552-f9604011beff - https://codevigilant.com/disclosure/2021/wp-plugin-project-status/
CVE ID: CVE-2021-24559 State: PUBLISHED Published: 2024-01-16T15:48:44.511Z Last Updated: 2025-06-20T16:54:49.993Z Vendors: Unknown Products: Qyrr Problem Types: CWE-79 Cross-Site Scripting (XSS), CWE-352 Cross-Site Request Forgery (CSRF) Description: The Qyrr WordPress plugin before 0.7 does not escape the data-uri of the QR Code when outputting it in a src attribute, allowing for Cross-Site Scripting attacks. Furthermore, the data_uri_to_meta AJAX action, available to all authenticated users, only had a CSRF check in place, with the nonce available to users with a role as low as Contributor allowing any user with such role (and above) to set a malicious data-uri in arbitrary QR Code posts,
low as Contributor allowing any user with such role (and above) to set a malicious data-uri in arbitrary QR Code posts, leading to a Stored Cross-Site Scripting issue. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/65a29976-163a-4bbf-a4e8-590ddc4b83f2/
CVE ID: CVE-2021-24560 State: PUBLISHED Published: 2021-09-13T17:56:25 Last Updated: 2024-08-03T19:35:20.180Z Vendors: Unknown Products: Software License Manager Problem Types: CWE-79 Description: The Software License Manager WordPress plugin before 4.4.8 does not sanitise or escape the edit_record parameter before outputting it back in the page in the admin dashboard, leading to a Reflected Cross-Site Scripting issue Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/d51fcd97-e535-42dd-997a-edc2f5f12269
CVE ID: CVE-2021-24561 State: PUBLISHED Published: 2021-08-23T11:10:13 Last Updated: 2024-08-03T19:35:20.197Z Vendors: Unknown Products: WP SMS Problem Types: CWE-79 Description: The WP SMS WordPress plugin before 5.4.13 does not sanitise the "wp_group_name" parameter before outputting it back in the "Groups" page, leading to an Authenticated Stored Cross-Site Scripting issue Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/5433ef4c-4451-4b6e-992b-69c5eccabf90 - https://plugins.trac.wordpress.org/changeset/2570762/wp-sms
CVE ID: CVE-2021-24562 State: PUBLISHED Published: 2021-08-23T11:10:14 Last Updated: 2024-08-03T19:35:20.173Z Vendors: Unknown Products: LMS by LifterLMS – Online Course, Membership & Learning Management System Plugin for WordPress Problem Types: CWE-639 Description: The LMS by LifterLMS – Online Course, Membership & Learning Management System Plugin for WordPress plugin before 4.21.2 was affected by an IDOR issue, allowing students to see other student answers and grades Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/d45bb744-4a0d-4af0-aa16-71f7e3ea6e00 - https://make.lifterlms.com/2021/05/17/lifterlms-version-4-21-2/
CVE ID: CVE-2021-24563 State: PUBLISHED Published: 2021-10-11T10:45:30 Last Updated: 2024-08-03T19:35:20.198Z Vendors: Unknown Products: Frontend Uploader Problem Types: CWE-79 Description: The Frontend Uploader WordPress plugin through 1.3.2 does not prevent HTML files from being uploaded via its form, allowing unauthenticated user to upload a malicious HTML file containing JavaScript for example, which will be triggered when someone access the file directly Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/e53ef41e-a176-4d00-916a-3a03835370f1 - http://packetstormsecurity.com/files/165515/WordPress-Frontend-Uploader-1.3.2-Cross-Site-Scripting.
-916a-3a03835370f1 - http://packetstormsecurity.com/files/165515/WordPress-Frontend-Uploader-1.3.2-Cross-Site-Scripting.html
CVE ID: CVE-2021-24564 State: PUBLISHED Published: 2021-08-23T11:10:15 Last Updated: 2024-08-03T19:35:20.210Z Vendors: Unknown Products: WPFront Scroll Top Problem Types: CWE-79 Description: The WPFront Scroll Top WordPress plugin before 2.0.6.07225 does not sanitise or escape its Image ALT setting before outputting it attributes, leading to an Authenticated Stored Cross-Site Scripting issues even when the unfiltered_html capability is disallowed. Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/b25af0e1-392f-4305-ad44-50e64ef3dbdf
CVE ID: CVE-2021-24565 State: PUBLISHED Published: 2021-08-23T11:10:16 Last Updated: 2024-08-03T19:35:20.219Z Vendors: Unknown Products: Contact Form 7 Captcha Problem Types: CWE-79, CWE-352 Description: The Contact Form 7 Captcha WordPress plugin before 0.0.9 does not have any CSRF check in place when saving its settings, allowing attacker to make a logged in user with the manage_options change them. Furthermore, the settings are not escaped when output in attributes, leading to a Stored Cross-Site Scripting issue. Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/97bfef5e-2ee0-491a-a931-4f44c83e5be0 - https://plugins.trac.wordpress.org/change
ces: - https://wpscan.com/vulnerability/97bfef5e-2ee0-491a-a931-4f44c83e5be0 - https://plugins.trac.wordpress.org/changeset/2570402
CVE ID: CVE-2021-24566 State: PUBLISHED Published: 2024-01-16T15:48:44.185Z Last Updated: 2025-06-11T17:11:16.128Z Vendors: Unknown Products: FOX Problem Types: CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') Description: The WooCommerce Currency Switcher FOX WordPress plugin before 1.3.7 was vulnerable to LFI attacks via the "woocs" shortcode. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/a0bc4b13-53fe-462d-8306-8915196d3a5a/ - https://jetpack.com/2021/07/22/severe-vulnerability-patched-in-woocommerce-currency-switcher/
CVE ID: CVE-2021-24567 State: PUBLISHED Published: 2024-01-16T15:48:43.806Z Last Updated: 2024-08-29T14:33:52.001Z Vendors: Unknown Products: Simple Post Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The Simple Post WordPress plugin through 1.1 does not sanitize user input when an authenticated user Text value, then it does not escape these values when outputting to the browser leading to an Authenticated Stored XSS Cross-Site Scripting issue. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/a3cd3115-2181-4e14-8b39-4de096433847/
CVE ID: CVE-2021-24568 State: PUBLISHED Published: 2021-09-06T11:09:27 Last Updated: 2024-08-03T19:35:20.211Z Vendors: Unknown Products: AddToAny Share Buttons Problem Types: CWE-79 Description: The AddToAny Share Buttons WordPress plugin before 1.7.46 does not sanitise its Sharing Header setting when outputting it in frontend pages, allowing high privilege users such as admin to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/cf7c0207-adb2-44c6-9469-2b24dbfec83a
CVE ID: CVE-2021-24569 State: PUBLISHED Published: 2021-09-27T15:25:21 Last Updated: 2024-08-03T19:35:20.186Z Vendors: Unknown Products: Cookie Notice & Compliance for GDPR / CCPA Problem Types: CWE-79 Description: The Cookie Notice & Compliance for GDPR / CCPA WordPress plugin before 2.1.2 does not escape the value of its Button Text setting when outputting it in an attribute in the frontend, allowing high privilege users such as admin to perform Cross-Site Scripting even when the unfiltered_html capability is disallowed. Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/38053e05-4b17-4fa9-acd3-85d8529b202b
CVE ID: CVE-2021-24570 State: PUBLISHED Published: 2021-11-01T08:46:00 Last Updated: 2024-08-03T19:35:20.193Z Vendors: Unknown Products: Accept Donations with PayPal Problem Types: CWE-352, CWE-79 Description: The Accept Donations with PayPal WordPress plugin before 1.3.1 offers a function to create donation buttons, which internally are posts. The process to create a new button is lacking a CSRF check. An attacker could use this to make an authenticated admin create a new button. Furthermore, one of the Button field is not escaped before being output in an attribute when editing a Button, leading to a Stored Cross-Site Scripting issue as well. Additional Analyst Notes: - CVE Program Contain
diting a Button, leading to a Stored Cross-Site Scripting issue as well. Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/5c73754c-eebe-424a-9d3b-ca83eb53bf87 - https://plugins.trac.wordpress.org/changeset/2608073/
CVE ID: CVE-2021-24571 State: PUBLISHED Published: 2021-08-23T11:10:17 Last Updated: 2024-08-03T19:35:20.191Z Vendors: Unknown Products: HD Quiz Problem Types: CWE-79 Description: The HD Quiz WordPress plugin before 1.8.4 does not escape some of its Answers before outputting them in attribute when generating the Quiz, which could lead to Stored Cross-Site Scripting issues Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/377fd65f-3a8c-4f7a-9e40-046d52ec0eef