Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2021-38304 State: PUBLISHED Published: 2021-09-17T15:51:16 Last Updated: 2024-08-04T01:37:16.245Z Vendors: n/a Products: n/a Problem Types: n/a Description: Improper input validation in the National Instruments NI-PAL driver in versions 20.0.0 and prior may allow a privileged user to potentially enable escalation of privilege via local access. Additional Analyst Notes: - CVE Program Container: References: - https://www.ni.com/en-us/support/documentation/supplemental/21/improper-input-validation-in-ni-pal.html
CVE ID: CVE-2021-38305 State: PUBLISHED Published: 2021-08-09T20:48:52 Last Updated: 2024-08-04T01:37:16.314Z Vendors: n/a Products: n/a Problem Types: n/a Description: 23andMe Yamale before 3.0.8 allows remote attackers to execute arbitrary code via a crafted schema file. The schema parser uses eval as part of its processing, and tries to protect from malicious expressions by limiting the builtins that are passed to the eval. When processing the schema, each line is run through Python's eval function to make the validator available. A well-constructed string within the schema rules can execute system commands; thus, by exploiting the vulnerability, an attacker can run arbitrary code on the
ema rules can execute system commands; thus, by exploiting the vulnerability, an attacker can run arbitrary code on the image that invokes Yamale. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/23andMe/Yamale/releases/tag/3.0.8 - https://github.com/23andMe/Yamale/pull/165
CVE ID: CVE-2021-38306 State: PUBLISHED Published: 2021-08-24T12:33:14 Last Updated: 2024-08-04T01:37:16.378Z Vendors: n/a Products: n/a Problem Types: n/a Description: Network Attached Storage on LG N1T1*** 10124 devices allows an unauthenticated attacker to gain root access via OS command injection in the en/ajp/plugins/access.ssh/checkInstall.php destServer parameter. Additional Analyst Notes: - CVE Program Container: References: - https://www.lg.com/uk/support/product/lg-N1T1DD1 - https://www.lg.com/us/burners-drives/lg-N1T1-network-attached-storage - https://zerosecuritypenetrationtesting.com/?page_id=306
CVE ID: CVE-2021-38311 State: PUBLISHED Published: 2021-08-09T21:19:35 Last Updated: 2024-08-04T01:37:16.302Z Vendors: n/a Products: n/a Problem Types: n/a Description: In Contiki 3.0, potential nonterminating acknowledgment loops exist in the Telnet service. When the negotiated options are already disabled, servers still respond to DONT and WONT requests with WONT or DONT commands, which may lead to infinite acknowledgment loops, denial of service, and excessive CPU consumption. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/contiki-os/contiki/issues/2685
CVE ID: CVE-2021-38312 State: PUBLISHED Published: 2021-09-02T16:53:39.328Z Last Updated: 2025-05-05T14:50:05.893Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L) Vendors: Redux.io Products: Gutenberg Template Library & Redux Framework Problem Types: CWE-863, CWE-280 Description: The Gutenberg Template Library & Redux Framework plugin <= 4.2.11 for WordPress used an incorrect authorization check in the REST API endpoints registered under the “redux/v1/templates/” REST Route in “redux-templates/classes/class-api.php”. The `permissions_callback` used in this file only checked for the `edit_posts` capability which is granted to lower-privileged users such as contributors,
this file only checked for the `edit_posts` capability which is granted to lower-privileged users such as contributors, allowing such users to install arbitrary plugins from the WordPress repository and edit arbitrary posts. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/blog/2021/09/over-1-million-sites-affected-by-redux-framework-vulnerabilities/
CVE ID: CVE-2021-38314 State: PUBLISHED Published: 2021-09-02T16:53:54.200Z Last Updated: 2025-05-05T14:49:49.173Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: Redux.io Products: Gutenberg Template Library & Redux Framework Problem Types: CWE-200, CWE-760 Description: The Gutenberg Template Library & Redux Framework plugin <= 4.2.11 for WordPress registered several AJAX actions available to unauthenticated users in the `includes` function in `redux-core/class-redux-core.php` that were unique to a given site but deterministic and predictable given that they were based on an md5 hash of the site URL with a known salt value of '-redux' and an md5 hash of the
ble given that they were based on an md5 hash of the site URL with a known salt value of '-redux' and an md5 hash of the previous hash with a known salt value of '-support'. These AJAX actions could be used to retrieve a list of active plugins and their versions, the site's PHP version, and an unsalted md5 hash of site’s `AUTH_KEY` concatenated with the `SECURE_AUTH_KEY`. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/blog/2021/09/over-1-million-sites-affected-by-redux-framework-vulnerabilities/
CVE ID: CVE-2021-38315 State: PUBLISHED Published: 2021-08-16T18:49:23.979Z Last Updated: 2025-05-05T18:15:07.517Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: SmartyPants Products: SP Project & Document Manager Problem Types: CWE-79 Description: The SP Project & Document Manager WordPress plugin is vulnerable to attribute-based Reflected Cross-Site Scripting via the from and to parameters in the ~/functions.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 4.25. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/vulnerability-advisories/#CVE-20
CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/vulnerability-advisories/#CVE-2021-38315 - https://plugins.trac.wordpress.org/browser/sp-client-document-manager/trunk/functions.php?rev=2566007#L1186
CVE ID: CVE-2021-38316 State: PUBLISHED Published: 2021-09-09T18:09:41.799Z Last Updated: 2025-05-05T18:14:49.822Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: WP Academic People List Products: WP Academic People List Problem Types: CWE-79 Description: The WP Academic People List WordPress plugin is vulnerable to Reflected Cross-Site Scripting via the category_name parameter in the ~/admin-panel.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 0.4.1. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/vulnerability-advisories/#CVE-2021-38316 - h
Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/vulnerability-advisories/#CVE-2021-38316 - https://plugins.trac.wordpress.org/browser/wp-academic-people/tags/0.4.1/admin-panel.php#L57
CVE ID: CVE-2021-38317 State: PUBLISHED Published: 2021-09-09T18:10:17.035Z Last Updated: 2025-05-05T16:39:18.432Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: Konnichiwa! Membership Products: Konnichiwa! Membership Problem Types: CWE-79 Description: The Konnichiwa! Membership WordPress plugin is vulnerable to Reflected Cross-Site Scripting via the plan_id parameter in the ~/views/subscriptions.html.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 0.8.3. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/vulnerability-advisories/#CVE-2021-38317
ram Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/vulnerability-advisories/#CVE-2021-38317 - https://plugins.trac.wordpress.org/browser/konnichiwa/trunk/views/subscriptions.html.php?rev=1625922#L7
CVE ID: CVE-2021-38318 State: PUBLISHED Published: 2021-09-09T18:09:29.218Z Last Updated: 2025-05-05T14:49:31.479Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: 3D Cover Carousel Products: 3D Cover Carousel Problem Types: CWE-79 Description: The 3D Cover Carousel WordPress plugin is vulnerable to Reflected Cross-Site Scripting via the id parameter in the ~/cover-carousel.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 1.0. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/vulnerability-advisories/#CVE-2021-38318 - https://plugins.trac.wordpres
chment: References: - https://www.wordfence.com/vulnerability-advisories/#CVE-2021-38318 - https://plugins.trac.wordpress.org/browser/3d-cover-carousel/trunk/cover-carousel.php?rev=1522904#L733
CVE ID: CVE-2021-38319 State: PUBLISHED Published: 2021-09-09T18:10:25.039Z Last Updated: 2025-05-05T16:39:01.703Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: More From Google Products: More From Google Problem Types: CWE-79 Description: The More From Google WordPress plugin is vulnerable to Reflected Cross-Site Scripting due to a reflected $_SERVER["PHP_SELF"] value in the ~/morefromgoogle.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 0.0.2. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/vulnerability-advisories/#CVE-2021-38319 - https
ainer: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/vulnerability-advisories/#CVE-2021-38319 - https://plugins.trac.wordpress.org/browser/more-from-google/trunk/morefromgoogle.php#L397
CVE ID: CVE-2021-38320 State: PUBLISHED Published: 2021-09-09T18:10:03.585Z Last Updated: 2025-05-05T16:40:12.177Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: simpleSAMLphp Authentication Products: simpleSAMLphp Authentication Problem Types: CWE-79 Description: The simpleSAMLphp Authentication WordPress plugin is vulnerable to Reflected Cross-Site Scripting due to a reflected $_SERVER["PHP_SELF"] value in the ~/simplesamlphp-authentication.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 0.7.0. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.co
.7.0. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/vulnerability-advisories/#CVE-2021-38320 - https://plugins.trac.wordpress.org/browser/simplesamlphp-authentication/tags/0.7.0/simplesamlphp-authentication.php#L307
CVE ID: CVE-2021-38321 State: PUBLISHED Published: 2021-09-09T18:10:10.532Z Last Updated: 2025-05-05T16:39:41.160Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: Custom Menu Plugin Products: Custom Menu Plugin Problem Types: CWE-79 Description: The Custom Menu Plugin WordPress plugin is vulnerable to Reflected Cross-Site Scripting via the selected_menu parameter found in the ~/custom-menus.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 1.3.3. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/vulnerability-advisories/#CVE-2021-38321 - https://p
r: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/vulnerability-advisories/#CVE-2021-38321 - https://plugins.trac.wordpress.org/browser/custom-sub-menus/trunk/custom-menus.php?rev=2205549#L136
CVE ID: CVE-2021-38322 State: PUBLISHED Published: 2021-09-09T18:09:34.911Z Last Updated: 2025-05-05T14:49:15.624Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: Twitter Friends Widget Products: Twitter Friends Widget Problem Types: CWE-79 Description: The Twitter Friends Widget WordPress plugin is vulnerable to Reflected Cross-Site Scripting via the pmc_TF_user and pmc_TF_password parameter found in the ~/twitter-friends-widget.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 3.1. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/vulnerability-
Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/vulnerability-advisories/#CVE-2021-38322 - https://plugins.trac.wordpress.org/browser/twitter-friends-widget/trunk/twitter-friends-widget.php#L309
CVE ID: CVE-2021-38323 State: PUBLISHED Published: 2021-09-09T18:10:40.547Z Last Updated: 2025-05-05T14:48:42.203Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: RentPress Products: RentPress Problem Types: CWE-79 Description: The RentPress WordPress plugin is vulnerable to Reflected Cross-Site Scripting via the selections parameter found in the ~/src/rentPress/AjaxRequests.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 6.6.4. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/vulnerability-advisories/#CVE-2021-38323 - https://plugins.trac.word
lnrichment: References: - https://www.wordfence.com/vulnerability-advisories/#CVE-2021-38323 - https://plugins.trac.wordpress.org/browser/rentpress/tags/6.6.4/src/rentPress/AjaxRequests.php#L83
CVE ID: CVE-2021-38324 State: PUBLISHED Published: 2021-09-09T18:09:53.452Z Last Updated: 2025-05-05T16:40:39.109Z Severity: HIGH (CVSS 8.2 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:L) Vendors: SP Rental Manager Products: SP Rental Manager Problem Types: CWE-89 Description: The SP Rental Manager WordPress plugin is vulnerable to SQL Injection via the orderby parameter found in the ~/user/shortcodes.php file which allows attackers to retrieve information contained in a site's database, in versions up to and including 1.5.3. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/vulnerability-advisories/#CVE-2021-38324 - https://plu
- CISA ADP Vulnrichment: References: - https://www.wordfence.com/vulnerability-advisories/#CVE-2021-38324 - https://plugins.trac.wordpress.org/browser/sp-rental-manager/tags/1.5.3/user/shortcodes.php#L389
CVE ID: CVE-2021-38325 State: PUBLISHED Published: 2021-09-09T18:10:32.694Z Last Updated: 2025-05-05T14:48:59.394Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: User Activation Email Products: User Activation Email Problem Types: CWE-79 Description: The User Activation Email WordPress plugin is vulnerable to Reflected Cross-Site Scripting via the uae-key parameter found in the ~/user-activation-email.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 1.3.0. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/vulnerability-advisories/#CVE-2021-38325
ram Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/vulnerability-advisories/#CVE-2021-38325 - https://plugins.trac.wordpress.org/browser/user-activation-email/tags/1.3.0/user-activation-email.php#L191
CVE ID: CVE-2021-38326 State: PUBLISHED Published: 2021-09-10T13:32:44.208Z Last Updated: 2025-05-02T19:53:19.419Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: Post Title Counter Products: Post Title Counter Problem Types: CWE-79 Description: The Post Title Counter WordPress plugin is vulnerable to Reflected Cross-Site Scripting via the notice parameter found in the ~/post-title-counter.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 1.1. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/vulnerability-advisories/#CVE-2021-38326 - https://plug
- CISA ADP Vulnrichment: References: - https://www.wordfence.com/vulnerability-advisories/#CVE-2021-38326 - https://plugins.trac.wordpress.org/browser/post-title-counter/tags/1.1/post-title-counter.php#L87
CVE ID: CVE-2021-38327 State: PUBLISHED Published: 2021-09-10T13:34:36.579Z Last Updated: 2025-05-02T19:44:13.242Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: YouTube Video Inserter Products: YouTube Video Inserter Problem Types: CWE-79 Description: The YouTube Video Inserter WordPress plugin is vulnerable to Reflected Cross-Site Scripting due to a reflected $_SERVER["PHP_SELF"] value in the ~/adminUI/settings.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 1.2.1.0. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/vulnerability-advisories/#
es: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/vulnerability-advisories/#CVE-2021-38327 - https://plugins.trac.wordpress.org/browser/youtube-video-inserter/trunk/adminUI/settings.php#L67
CVE ID: CVE-2021-38328 State: PUBLISHED Published: 2021-09-10T13:33:35.720Z Last Updated: 2025-05-02T20:11:58.798Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: Notices Products: Notices Problem Types: CWE-79 Description: The Notices WordPress plugin is vulnerable to Reflected Cross-Site Scripting due to a reflected $_SERVER["PHP_SELF"] value in the ~/notices.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 6.1. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/vulnerability-advisories/#CVE-2021-38328 - https://plugins.trac.wordpress.org/browse
rences: - https://www.wordfence.com/vulnerability-advisories/#CVE-2021-38328 - https://plugins.trac.wordpress.org/browser/notices/trunk/notices.php?rev=606181#L353
CVE ID: CVE-2021-38329 State: PUBLISHED Published: 2021-09-10T13:33:41.126Z Last Updated: 2025-05-02T20:10:31.403Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: DJ EmailPublish Products: DJ EmailPublish Problem Types: CWE-79 Description: The DJ EmailPublish WordPress plugin is vulnerable to Reflected Cross-Site Scripting due to a reflected $_SERVER["PHP_SELF"] value in the ~/dj-email-publish.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 1.7.2. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/vulnerability-advisories/#CVE-2021-38329 - https:
iner: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/vulnerability-advisories/#CVE-2021-38329 - https://plugins.trac.wordpress.org/browser/dj-email-publish/tags/1.7.2/dj-email-publish.php#L259
CVE ID: CVE-2021-38330 State: PUBLISHED Published: 2021-09-10T13:32:21.877Z Last Updated: 2025-05-02T19:48:58.949Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: Yet Another bol.com Plugin Products: Yet Another bol.com Plugin Problem Types: CWE-79 Description: The Yet Another bol.com Plugin WordPress plugin is vulnerable to Reflected Cross-Site Scripting due to a reflected $_SERVER["PHP_SELF"] value in the ~/yabp.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 1.4. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/vulnerability-advisories/#CVE-
- CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/vulnerability-advisories/#CVE-2021-38330 - https://plugins.trac.wordpress.org/browser/yabp/tags/1.4/yabp.php#L454
CVE ID: CVE-2021-38331 State: PUBLISHED Published: 2021-09-10T13:33:25.098Z Last Updated: 2025-05-02T20:13:29.308Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: WP-T-Wap Products: WP-T-Wap Problem Types: CWE-79 Description: The WP-T-Wap WordPress plugin is vulnerable to Reflected Cross-Site Scripting via the posted parameter found in the ~/wap/writer.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 1.13.2. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/vulnerability-advisories/#CVE-2021-38331 - https://plugins.trac.wordpress.org/browser/wp-t
: - https://www.wordfence.com/vulnerability-advisories/#CVE-2021-38331 - https://plugins.trac.wordpress.org/browser/wp-t-wap/tags/1.13.3/wap/writer.php#L34
CVE ID: CVE-2021-38332 State: PUBLISHED Published: 2021-09-10T13:32:33.564Z Last Updated: 2025-05-02T19:48:22.176Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: On Page SEO + Whatsapp Chat Button Products: On Page SEO + Whatsapp Chat Button Problem Types: CWE-79 Description: The On Page SEO + Whatsapp Chat Button Plugin WordPress plugin is vulnerable to Reflected Cross-Site Scripting due to a reflected $_SERVER["PHP_SELF"] value in the ~/settings.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 1.0.1. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfen
ing 1.0.1. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/vulnerability-advisories/#CVE-2021-38332 - https://plugins.trac.wordpress.org/browser/ops-robots-txt/tags/1.0.0/settings.php#L175
CVE ID: CVE-2021-38333 State: PUBLISHED Published: 2021-09-10T13:33:19.045Z Last Updated: 2025-05-02T20:13:47.200Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: WP Scrippets Products: WP Scrippets Problem Types: CWE-79 Description: The WP Scrippets WordPress plugin is vulnerable to Reflected Cross-Site Scripting due to a reflected $_SERVER["PHP_SELF"] value in the ~/wp-scrippets.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 1.5.1. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/vulnerability-advisories/#CVE-2021-38333 - https://plugins.tra
ADP Vulnrichment: References: - https://www.wordfence.com/vulnerability-advisories/#CVE-2021-38333 - https://plugins.trac.wordpress.org/browser/wp-scrippets/tags/1.5.1/wp-scrippets.php#L123
CVE ID: CVE-2021-38334 State: PUBLISHED Published: 2021-09-10T13:32:16.386Z Last Updated: 2025-05-02T19:49:14.651Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: WP Design Maps & Places Products: WP Design Maps & Places Problem Types: CWE-79 Description: The WP Design Maps & Places WordPress plugin is vulnerable to Reflected Cross-Site Scripting via the filename parameter found in the ~/wpdmp-admin.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 1.2. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/vulnerability-advisories/#CVE-2021-38334 - ht
ontainer: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/vulnerability-advisories/#CVE-2021-38334 - https://plugins.trac.wordpress.org/browser/wp-design-maps-places/tags/1.2/wpdmp-admin.php#L192
CVE ID: CVE-2021-38335 State: PUBLISHED Published: 2021-09-10T13:33:48.365Z Last Updated: 2025-05-02T19:48:04.823Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: Wise Agent Capture Forms Products: Wise Agent Capture Forms Problem Types: CWE-79 Description: The Wise Agent Capture Forms WordPress plugin is vulnerable to Reflected Cross-Site Scripting due to a reflected $_SERVER["PHP_SELF"] value in the ~/WiseAgentCaptureForm.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 1.0. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/vulnerability-adviso
st Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/vulnerability-advisories/#CVE-2021-38335 - https://plugins.trac.wordpress.org/browser/wiseagentleadform/tags/2.0/WiseAgentCaptureForm.php#L44