Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2021-24294 State: PUBLISHED Published: 2021-05-24T10:58:03 Last Updated: 2024-08-03T19:28:23.687Z Vendors: Michael Leithold Products: DSGVO All in one for WP Problem Types: CWE-79 Description: The dsgvoaio_write_log AJAX action of the DSGVO All in one for WP WordPress plugin before 4.0 did not sanitise or escape some POST parameter submitted before outputting them in the Log page in the administrator dashboard (wp-admin/admin.php?page=dsgvoaiofree-show-log). This could allow unauthenticated attackers to gain unauthorised access by using an XSS payload to create a rogue administrator account, which will be trigged when an administrator will view the logs. Additional Analyst Notes:
a rogue administrator account, which will be trigged when an administrator will view the logs. Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/43b8cfb4-f875-432b-8e3b-52653fdee87c
CVE ID: CVE-2021-24295 State: PUBLISHED Published: 2021-05-17T16:48:53 Last Updated: 2024-08-03T19:28:23.468Z Vendors: СleanTalk Products: Spam protection, AntiSpam, FireWall by CleanTalk Problem Types: CWE-89 Description: It was possible to exploit an Unauthenticated Time-Based Blind SQL Injection vulnerability in the Spam protection, AntiSpam, FireWall by CleanTalk WordPress Plugin before 5.153.4. The update_log function in lib/Cleantalk/ApbctWP/Firewall/SFW.php included a vulnerable query that could be injected via the User-Agent Header by manipulating the cookies set by the Spam protection, AntiSpam, FireWall by CleanTalk WordPress plugin before 5.153.4, sending an initial request to obt
the Spam protection, AntiSpam, FireWall by CleanTalk WordPress plugin before 5.153.4, sending an initial request to obtain a ct_sfw_pass_key cookie and then manually setting a separate ct_sfw_passed cookie and disallowing it from being reset. Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/152171fc-888c-4275-a118-5a1e664ef28b - https://www.wordfence.com/blog/2021/05/sql-injection-vulnerability-patched-in-cleantalk-antispam-plugin/
CVE ID: CVE-2021-24296 State: PUBLISHED Published: 2021-05-24T10:58:04 Last Updated: 2024-08-03T19:28:23.433Z Vendors: Go Web Solutions Products: WP Customer Reviews Problem Types: CWE-79 Description: The WP Customer Reviews WordPress plugin before 3.5.6 did not sanitise some of its settings, allowing high privilege users such as administrators to set XSS payloads in them which will then be triggered in pages where reviews are enabled Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/c450f54a-3372-49b2-8ad8-68d5cc0dd49e
CVE ID: CVE-2021-24297 State: PUBLISHED Published: 2021-05-24T10:58:04 Last Updated: 2024-08-03T19:28:23.925Z Vendors: Unknown Products: Goto Problem Types: CWE-79 Description: The Goto WordPress theme before 2.1 did not properly sanitize the formvalue JSON POST parameter in its tl_filter AJAX action, leading to an unauthenticated Reflected Cross-site Scripting (XSS) vulnerability. Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/a64a3b2e-7924-47aa-96e8-3aa02a6cdccc
CVE ID: CVE-2021-24298 State: PUBLISHED Published: 2021-05-24T10:58:04 Last Updated: 2024-08-03T19:28:23.261Z Vendors: Igor Benic Products: Simple Giveaways – Grow your business, email lists and traffic with contests Problem Types: CWE-79 Description: The method and share GET parameters of the Giveaway pages were not sanitised, validated or escaped before being output back in the pages, thus leading to reflected XSS Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/30aebded-3eb3-4dda-90b5-12de5e622c91 - https://codevigilant.com/disclosure/2021/wp-plugin-giveasap-xss/
CVE ID: CVE-2021-24299 State: PUBLISHED Published: 2021-05-17T16:48:53 Last Updated: 2024-08-03T19:28:23.396Z Vendors: Reservation Diary Products: ReDi Restaurant Reservation Problem Types: CWE-79 Description: The ReDi Restaurant Reservation WordPress plugin before 21.0426 provides the functionality to let users make restaurant reservations. These reservations are stored and can be listed on an 'Upcoming' page provided by the plugin. An unauthenticated user can fill in the form to make a restaurant reservation. The form to make a restaurant reservation field called 'Comment' does not use proper input validation and can be used to store XSS payloads. The XSS payloads will be executed when the
' does not use proper input validation and can be used to store XSS payloads. The XSS payloads will be executed when the plugin user goes to the 'Upcoming' page, which is an external website https://upcoming.reservationdiary.eu/ loaded in an iframe, and the stored reservation with XSS payload is loaded. Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/fd6ce00b-8c5f-4180-b648-f47b37303670 - http://packetstormsecurity.com/files/162756/WordPress-ReDi-Restaurant-Reservation-21.0307-Cross-Site-Scripting.html
CVE ID: CVE-2021-24300 State: PUBLISHED Published: 2021-05-24T10:58:04 Last Updated: 2024-08-03T19:28:23.414Z Vendors: PickPlugins Products: PickPlugins Product Slider for WooCommerce Problem Types: CWE-79 Description: The slider import search feature of the PickPlugins Product Slider for WooCommerce WordPress plugin before 1.13.22 did not properly sanitised the keyword GET parameter, leading to reflected Cross-Site Scripting issue Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/5fbbc7ad-3f1a-48a1-b2eb-e57f153eb837
CVE ID: CVE-2021-24301 State: PUBLISHED Published: 2021-05-24T10:58:04 Last Updated: 2024-08-03T19:28:23.464Z Vendors: Blue Medicine Labs Products: Hotjar Connecticator Problem Types: CWE-79 Description: The Hotjar Connecticator WordPress plugin through 1.1.1 is vulnerable to Stored Cross-Site Scripting (XSS) in the 'hotjar script' textarea. The request did include a CSRF nonce that was properly verified by the server and this vulnerability could only be exploited by administrator users. Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/eb8e2b9d-f153-49c9-862a-5c016934f9ad
CVE ID: CVE-2021-24302 State: PUBLISHED Published: 2021-05-24T10:58:04 Last Updated: 2024-08-03T19:28:23.454Z Vendors: HanaDaddy Products: Hana Flv Player Problem Types: CWE-79 Description: The Hana Flv Player WordPress plugin through 3.1.3 is vulnerable to an Authenticated Stored Cross-Site Scripting (XSS) vulnerability within the 'Default Skin' field. Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/372a66ca-1c3c-4429-86a5-81dbdaa9ec7d
CVE ID: CVE-2021-24303 State: PUBLISHED Published: 2021-09-06T11:09:18 Last Updated: 2024-08-03T19:28:23.552Z Vendors: Unknown Products: JiangQie Official Website Mini Program Problem Types: CWE-89 Description: The JiangQie Official Website Mini Program WordPress plugin before 1.1.1 does not escape or validate the id GET parameter before using it in SQL statements, leading to SQL injection issues Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/cbd65b7d-d3c3-4ee3-8e5e-ff0eeeaa7b30 - https://github.com/ja9er/CVEProject/blob/main/wordpress_jiangqie-official-website-mini-program_sqli.md
CVE ID: CVE-2021-24304 State: PUBLISHED Published: 2021-08-09T10:04:04 Last Updated: 2024-08-03T19:28:23.440Z Vendors: Unknown Products: Newsmag Problem Types: CWE-79 Description: The Newsmag WordPress theme before 5.0 does not sanitise the td_block_id parameter in its td_ajax_block AJAX action, leading to an unauthenticated Reflected Cross-site Scripting (XSS) vulnerability. Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/bb71f2f9-76bd-43f4-a8c9-35771dd28dff
CVE ID: CVE-2021-24305 State: PUBLISHED Published: 2021-05-24T10:58:04 Last Updated: 2024-08-03T19:28:23.422Z Vendors: TargetFirst Products: Target First Plugin Problem Types: CWE-79 Description: The Target First WordPress Plugin v2.0, also previously known as Watcheezy, suffers from a critical unauthenticated stored XSS vulnerability. An attacker could change the licence key value through a POST on any URL with the 'weeWzKey' parameter that will be save as the 'weeID option and is not sanitized. Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/4d55d1f5-a7b8-4029-942d-7a13e2498f64 - https://www.targetfirst.com/
CVE ID: CVE-2021-24306 State: PUBLISHED Published: 2021-05-24T10:58:05 Last Updated: 2024-08-03T19:28:22.814Z Vendors: Ultimate Member Products: Ultimate Member – User Profile, User Registration, Login & Membership Plugin Problem Types: CWE-79 Description: The Ultimate Member – User Profile, User Registration, Login & Membership Plugin WordPress plugin before 2.1.20 did not properly sanitise, validate or encode the query string when generating a link to edit user's own profile, leading to an authenticated reflected Cross-Site Scripting issue. Knowledge of the targeted username is required to exploit this, and attackers would then need to make the related logged in user open a malicious link.
ame is required to exploit this, and attackers would then need to make the related logged in user open a malicious link. Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/35516555-c50c-486a-886c-df49c9e51e2c
CVE ID: CVE-2021-24307 State: PUBLISHED Published: 2021-05-24T10:58:05 Last Updated: 2024-08-03T19:28:23.581Z Vendors: All in One SEO Team Products: All in One SEO – Best WordPress SEO Plugin – Easily Improve Your SEO Rankings Problem Types: CWE-502 Description: The All in One SEO – Best WordPress SEO Plugin – Easily Improve Your SEO Rankings before 4.1.0.2 enables authenticated users with "aioseo_tools_settings" privilege (most of the time admin) to execute arbitrary code on the underlying host. Users can restore plugin's configuration by uploading a backup .ini file in the section "Tool > Import/Export". However, the plugin attempts to unserialize values of the .ini file. Moreover, the plu
e section "Tool > Import/Export". However, the plugin attempts to unserialize values of the .ini file. Moreover, the plugin embeds Monolog library which can be used to craft a gadget chain and thus trigger system command execution. Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/ab2c94d2-f6c4-418b-bd14-711ed164bcf1 - https://aioseo.com/changelog/
CVE ID: CVE-2021-24308 State: PUBLISHED Published: 2021-05-24T10:58:05 Last Updated: 2024-08-03T19:28:23.207Z Vendors: LifterLMS Products: LMS by LifterLMS – Online Course, Membership & Learning Management System Plugin for WordPress Problem Types: CWE-79 Description: The 'State' field of the Edit profile page of the LMS by LifterLMS – Online Course, Membership & Learning Management System Plugin for WordPress plugin before 4.21.1 is not properly sanitised when output in the About section of the profile page, leading to a stored Cross-Site Scripting issue. This could allow low privilege users (such as students) to elevate their privilege via an XSS attack when an admin will view their profil
low privilege users (such as students) to elevate their privilege via an XSS attack when an admin will view their profile. Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/f29f68a5-6575-441d-98c9-867145f2b082 - https://github.com/gocodebox/lifterlms/releases/tag/4.21.1 - http://packetstormsecurity.com/files/162856/WordPress-LifterLMS-4.21.0-Cross-Site-Scripting.html
CVE ID: CVE-2021-24309 State: PUBLISHED Published: 2021-06-01T11:33:29 Last Updated: 2024-08-03T19:28:23.445Z Vendors: Unknown Products: Weekly Schedule Problem Types: CWE-79 Description: The "Schedule Name" input in the Weekly Schedule WordPress plugin before 3.4.3 general options did not properly sanitize input, allowing a user to inject javascript code using the <script> HTML tags and cause a stored XSS issue Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/ba1d01dc-16e4-464f-94be-ed311ff6ccf9
CVE ID: CVE-2021-24310 State: PUBLISHED Published: 2021-06-01T11:33:29 Last Updated: 2024-08-03T19:28:23.379Z Vendors: 10Web Products: Photo Gallery by 10Web – Mobile-Friendly Image Gallery Problem Types: CWE-79 Description: The Photo Gallery by 10Web - Mobile-Friendly Image Gallery WordPress plugin before 1.5.67 did not properly sanitise the gallery title, allowing high privilege users to create one with XSS payload in it, which will be triggered when another user will view the gallery list or the affected gallery in the admin dashboard. This is due to an incomplete fix of CVE-2019-16117 Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/f34096
CVE-2019-16117 Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/f34096ec-b1b0-471d-88a4-4699178a3165
CVE ID: CVE-2021-24311 State: PUBLISHED Published: 2021-06-01T11:33:29 Last Updated: 2024-08-03T19:28:23.439Z Vendors: Unknown Products: External Media Problem Types: CWE-434 Description: The wp_ajax_upload-remote-file AJAX action of the External Media WordPress plugin before 1.0.34 was vulnerable to arbitrary file uploads via any authenticated users. Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/4fb90999-6f91-4200-a0cc-bfe9b34a5de9 - https://www.wordfence.com/blog/2021/05/critical-vulnerability-patched-in-external-media-plugin/
CVE ID: CVE-2021-24312 State: PUBLISHED Published: 2021-06-01T11:33:30 Last Updated: 2024-08-03T19:28:23.442Z Vendors: Automattic Products: WP Super Cache Problem Types: CWE-94 Description: The parameters $cache_path, $wp_cache_debug_ip, $wp_super_cache_front_page_text, $cache_scheduled_time, $cached_direct_pages used in the settings of WP Super Cache WordPress plugin before 1.7.3 result in RCE because they allow input of '$' and '\n'. This is due to an incomplete fix of CVE-2021-24209. Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/2142c3d3-9a7f-4e3c-8776-d469a355d62f
CVE ID: CVE-2021-24313 State: PUBLISHED Published: 2021-06-01T11:33:30 Last Updated: 2024-08-03T19:28:23.788Z Vendors: Unknown Products: WP Prayer Problem Types: CWE-79 Description: The WP Prayer WordPress plugin before 1.6.2 provides the functionality to store requested prayers/praises and list them on a WordPress website. These stored prayer/praise requests can be listed by using the WP Prayer engine. An authenticated WordPress user with any role can fill in the form to request a prayer. The form to request prayers or praises have several fields. The 'prayer request' and 'praise request' fields do not use proper input validation and can be used to store XSS payloads. Additional Analyst Not
'praise request' fields do not use proper input validation and can be used to store XSS payloads. Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/c7ab736d-27c4-4ec5-9681-a3f0dda86586 - https://bastijnouwendijk.com/cve-2021-24313/
CVE ID: CVE-2021-24314 State: PUBLISHED Published: 2021-05-17T16:48:53 Last Updated: 2024-08-03T19:28:23.496Z Vendors: BoostifyThemes Products: Goto Problem Types: CWE-89 Description: The Goto WordPress theme before 2.1 did not sanitise, validate of escape the keywords GET parameter from its listing page before using it in a SQL statement, leading to an Unauthenticated SQL injection issue Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/1cc6dc17-b019-49dd-8149-c8bba165eb30 - https://m0ze.ru/vulnerability/%5B2021-03-24%5D-%5BWordPress%5D-%5BCWE-89%5D-Goto-WordPress-Theme-v2.0.txt
CVE ID: CVE-2021-24315 State: PUBLISHED Published: 2021-05-17T16:48:53 Last Updated: 2024-08-03T19:28:23.446Z Vendors: GiveWP Products: GiveWP – Donation Plugin and Fundraising Platform Problem Types: CWE-79 Description: The GiveWP – Donation Plugin and Fundraising Platform WordPress plugin before 2.10.4 did not sanitise or escape the Background Image field of its Stripe Checkout Setting and Logo field in its Email settings, leading to authenticated (admin+) Stored XSS issues. Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/006b37c9-641c-4676-a315-9b6053e001d2 - https://m0ze.ru/vulnerability/%5B2021-04-02%5D-%5BWordPress%5D-%5BCWE-79%5D-GiveW
006b37c9-641c-4676-a315-9b6053e001d2 - https://m0ze.ru/vulnerability/%5B2021-04-02%5D-%5BWordPress%5D-%5BCWE-79%5D-GiveWP-WordPress-Plugin-v2.10.3.txt
CVE ID: CVE-2021-24316 State: PUBLISHED Published: 2021-06-01T11:33:30 Last Updated: 2024-08-03T19:28:23.425Z Vendors: WowThemes Products: Mediumish Problem Types: CWE-79 Description: The search feature of the Mediumish WordPress theme through 1.0.47 does not properly sanitise it's 's' GET parameter before output it back the page, leading to the Cross-SIte Scripting issue. Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/57e27de4-58f5-46aa-9b59-809705733b2e - https://m0ze.ru/vulnerability/%5B2021-03-14%5D-%5BWordPress%5D-%5BCWE-79%5D-Mediumish-WordPress-Theme-v1.0.47.txt - https://www.wowthemes.net/themes/mediumish-wordpress/
CVE ID: CVE-2021-24317 State: PUBLISHED Published: 2021-06-01T11:33:30 Last Updated: 2024-08-03T19:28:23.412Z Vendors: purethemes Products: Listeo Problem Types: CWE-79 Description: The Listeo WordPress theme before 1.6.11 did not properly sanitise some parameters in its Search, Booking Confirmation and Personal Message pages, leading to Cross-Site Scripting issues Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/704d8886-df9e-4217-88d1-a72a71924174 - https://m0ze.ru/vulnerability/%5B2021-02-10%5D-%5BWordPress%5D-%5BCWE-79%5D-Listeo-WordPress-Theme-v1.6.10.txt
CVE ID: CVE-2021-24318 State: PUBLISHED Published: 2021-06-01T11:33:30 Last Updated: 2024-08-03T19:28:23.792Z Vendors: purethemes Products: Listeo Problem Types: CWE-284 Description: The Listeo WordPress theme before 1.6.11 did not ensure that the Post/Page and Booking to delete belong to the user making the request, allowing any authenticated users to delete arbitrary page/post and booking via an IDOR vector. Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/9afa7e11-68b3-4196-975e-8b3f8e68ce56 - https://m0ze.ru/vulnerability/%5B2021-02-10%5D-%5BWordPress%5D-%5BCWE-639%5D-Listeo-WordPress-Theme-v1.6.10.txt
CVE ID: CVE-2021-24319 State: PUBLISHED Published: 2021-06-01T11:33:30 Last Updated: 2024-08-03T19:28:23.586Z Vendors: BoldThemes Products: Bello - Directory & Listing Problem Types: CWE-79 Description: The Bello - Directory & Listing WordPress theme before 1.6.0 did not properly sanitise its post_excerpt parameter before outputting it back in the shop/my-account/bello-listing-endpoint/ page, leading to a Cross-Site Scripting issue Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/2c274eb7-25f1-49d4-a2c8-8ce8cecebe68 - https://m0ze.ru/vulnerability/%5B2021-03-21%5D-%5BWordPress%5D-%5BCWE-1021%5D-Bello-WordPress-Theme-v1.5.9.txt
CVE ID: CVE-2021-24320 State: PUBLISHED Published: 2021-06-01T11:33:30 Last Updated: 2024-08-03T19:28:23.476Z Vendors: BoldThemes Products: Bello - Directory & Listing Problem Types: CWE-79 Description: The Bello - Directory & Listing WordPress theme before 1.6.0 did not properly sanitise and escape its listing_list_view, bt_bb_listing_field_my_lat, bt_bb_listing_field_my_lng, bt_bb_listing_field_distance_value, bt_bb_listing_field_my_lat_default, bt_bb_listing_field_keyword, bt_bb_listing_field_location_autocomplete, bt_bb_listing_field_price_range_from and bt_bb_listing_field_price_range_to parameter in ints listing page, leading to reflected Cross-Site Scripting issues. Additional Analyst
ield_price_range_to parameter in ints listing page, leading to reflected Cross-Site Scripting issues. Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/6b5b42fd-028a-4405-b027-3266058029bb - https://m0ze.ru/vulnerability/%5B2021-03-21%5D-%5BWordPress%5D-%5BCWE-79%5D-Bello-WordPress-Theme-v1.5.9.txt
CVE ID: CVE-2021-24321 State: PUBLISHED Published: 2021-06-01T11:33:30 Last Updated: 2024-08-03T19:28:23.407Z Vendors: BoldThemes Products: Bello - Directory & Listing Problem Types: CWE-89 Description: The Bello - Directory & Listing WordPress theme before 1.6.0 did not sanitise the bt_bb_listing_field_price_range_to, bt_bb_listing_field_now_open, bt_bb_listing_field_my_lng, listing_list_view and bt_bb_listing_field_my_lat parameters before using them in a SQL statement, leading to SQL Injection issues Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/7314f9fa-c047-4e0c-b145-940240a50c02 - https://m0ze.ru/vulnerability/%5B2021-03-21%5D-%5BWord
//wpscan.com/vulnerability/7314f9fa-c047-4e0c-b145-940240a50c02 - https://m0ze.ru/vulnerability/%5B2021-03-21%5D-%5BWordPress%5D-%5BCWE-89%5D-Bello-WordPress-Theme-v1.5.9.txt
CVE ID: CVE-2021-24322 State: PUBLISHED Published: 2021-06-01T11:33:31 Last Updated: 2024-08-03T19:28:23.384Z Vendors: Delicious Brains Products: Database Backup for WordPress Problem Types: CWE-79 Description: The Database Backup for WordPress plugin before 2.4 did not escape the backup_recipient POST parameter in before output it back in the attribute of an HTML tag, leading to a Stored Cross-Site Scripting issue. Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/6bea6301-0762-45c3-a4eb-15d6ac4f9f37 - https://m0ze.ru/vulnerability/%5B2021-04-04%5D-%5BWordPress%5D-%5BCWE-79%5D-WP-DB-Backup-WordPress-Plugin-v2.3.3.txt
CVE ID: CVE-2021-24323 State: PUBLISHED Published: 2021-05-17T16:48:53 Last Updated: 2024-08-03T19:28:23.704Z Vendors: Automattic Products: WooCommerce Problem Types: CWE-79 Description: When taxes are enabled, the "Additional tax classes" field was not properly sanitised or escaped before being output back in the admin dashboard, allowing high privilege users such as admin to use XSS payloads even when the unfiltered_html is disabled Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/6d262555-7ae4-4e36-add6-4baa34dc3010
CVE ID: CVE-2021-24324 State: PUBLISHED Published: 2021-05-17T16:48:53 Last Updated: 2024-08-03T19:28:23.398Z Vendors: Unknown Products: 404 SEO Redirection Problem Types: CWE-352 Description: The 404 SEO Redirection WordPress plugin through 1.3 is lacking CSRF checks in all its settings, allowing attackers to make a logged in user change the plugin's settings. Due to the lack of sanitisation and escaping in some fields, it could also lead to Stored Cross-Site Scripting issues Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/63a24890-3735-4016-b4b7-4b070a842664
CVE ID: CVE-2021-24325 State: PUBLISHED Published: 2021-05-17T16:48:54 Last Updated: 2024-08-03T19:28:23.471Z Vendors: Unknown Products: 404 SEO Redirection Problem Types: CWE-79 Description: The tab parameter of the settings page of the 404 SEO Redirection WordPress plugin through 1.3 is vulnerable to a reflected Cross-Site Scripting (XSS) issue as user input is not properly sanitised or escaped before being output in an attribute. Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/96e9a7fd-9ab8-478e-9420-4bca2a0b23a1
CVE ID: CVE-2021-24326 State: PUBLISHED Published: 2021-05-17T16:48:54 Last Updated: 2024-08-03T19:28:23.408Z Vendors: Unknown Products: All 404 Redirect to Homepage Problem Types: CWE-79 Description: The tab parameter of the settings page of the All 404 Redirect to Homepage WordPress plugin before 1.21 was vulnerable to an authenticated reflected Cross-Site Scripting (XSS) issue as user input was not properly sanitised before being output in an attribute. Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/63d6ca03-e0df-40db-9839-531c13619094