Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2021-34619 State: PUBLISHED Published: 2021-07-21T11:09:37.170930Z Last Updated: 2024-09-16T22:35:25.662Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: StoreApps Products: WooCommerce Stock Manager Problem Types: CWE-352, CWE-434 Description: The WooCommerce Stock Manager WordPress plugin is vulnerable to Cross-Site Request Forgery leading to Arbitrary File Upload in versions up to, and including, 2.5.7 due to missing nonce and file validation in the /woocommerce-stock-manager/trunk/admin/views/import-export.php file. Additional Analyst Notes: - CVE Program Container: References: - https://plugins.trac.wordpress.org/browser/woocommerce-stock-mana
Analyst Notes: - CVE Program Container: References: - https://plugins.trac.wordpress.org/browser/woocommerce-stock-manager/trunk/admin/views/import-export.php?rev=2499178 - https://www.wordfence.com/blog/2021/06/high-severity-vulnerability-patched-in-woocommerce-stock-manager-plugin/
CVE ID: CVE-2021-34620 State: PUBLISHED Published: 2021-07-07T12:21:04.343417Z Last Updated: 2024-10-15T19:09:35.687Z Vendors: WP Manage Ninja Products: WP Fluent Forms Problem Types: CWE-352, CWE-79 Description: The WP Fluent Forms plugin < 3.6.67 for WordPress is vulnerable to Cross-Site Request Forgery leading to stored Cross-Site Scripting and limited Privilege Escalation due to a missing nonce check in the access control function for administrative AJAX actions Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://plugins.trac.wordpress.org/browser/fluentform/trunk/app/Modules/Acl/Acl.php?rev=2196688 - https://www.wordfence.com/blog/2021/06/cr
c.wordpress.org/browser/fluentform/trunk/app/Modules/Acl/Acl.php?rev=2196688 - https://www.wordfence.com/blog/2021/06/cross-site-request-forgery-patched-in-wp-fluent-forms/
CVE ID: CVE-2021-34621 State: PUBLISHED Published: 2021-07-07T12:21:16.266655Z Last Updated: 2024-10-15T18:57:02.370Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: ProfilePress Products: ProfilePress Problem Types: CWE-269 Description: A vulnerability in the user registration component found in the ~/src/Classes/RegistrationAuth.php file of the ProfilePress WordPress plugin made it possible for users to register on sites as an administrator. This issue affects versions 3.0.0 - 3.1.3. . Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/blog/2021/06/easily-exploitable-critical-vulnerabilitie
- CISA ADP Vulnrichment: References: - https://www.wordfence.com/blog/2021/06/easily-exploitable-critical-vulnerabilities-patched-in-profilepress-plugin/ - http://packetstormsecurity.com/files/163973/WordPress-ProfilePress-3.1.3-Privilege-Escalation.html
CVE ID: CVE-2021-34622 State: PUBLISHED Published: 2021-07-07T12:20:58.388207Z Last Updated: 2024-10-15T19:10:53.294Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: ProfilePress Products: ProfilePress Problem Types: CWE-269 Description: A vulnerability in the user profile update component found in the ~/src/Classes/EditUserProfile.php file of the ProfilePress WordPress plugin made it possible for users to escalate their privileges to that of an administrator while editing their profile. This issue affects versions 3.0.0 - 3.1.3. . Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/blog/2021/
onal Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/blog/2021/06/easily-exploitable-critical-vulnerabilities-patched-in-profilepress-plugin/
CVE ID: CVE-2021-34623 State: PUBLISHED Published: 2021-07-07T12:21:10.704971Z Last Updated: 2024-10-15T19:06:17.719Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: ProfilePress Products: ProfilePress Problem Types: CWE-434 Description: A vulnerability in the image uploader component found in the ~/src/Classes/ImageUploader.php file of the ProfilePress WordPress plugin made it possible for users to upload arbitrary files during user registration or during profile updates. This issue affects versions 3.0.0 - 3.1.3. . Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/blog/2021/06/easily-explo
tes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/blog/2021/06/easily-exploitable-critical-vulnerabilities-patched-in-profilepress-plugin/
CVE ID: CVE-2021-34624 State: PUBLISHED Published: 2021-07-07T12:21:21.639477Z Last Updated: 2024-10-15T18:51:23.584Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: ProfilePress Products: ProfilePress Problem Types: CWE-434 Description: A vulnerability in the file uploader component found in the ~/src/Classes/FileUploader.php file of the ProfilePress WordPress plugin made it possible for users to upload arbitrary files during user registration or during profile updates. This issue affects versions 3.0.0 - 3.1.3. . Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/blog/2021/06/easily-exploit
s: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/blog/2021/06/easily-exploitable-critical-vulnerabilities-patched-in-profilepress-plugin/
CVE ID: CVE-2021-34625 State: PUBLISHED Published: 2021-07-07T12:21:38.493037Z Last Updated: 2024-09-16T18:56:07.715Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: WP Upload Restriction Products: WP Upload Restriction Problem Types: CWE-79 Description: A vulnerability in the saveCustomType function of the WP Upload Restriction WordPress plugin allows low-level authenticated users to inject arbitrary web scripts. This issue affects versions 2.2.3 and prior. Additional Analyst Notes: - CVE Program Container: References: - https://www.wordfence.com/vulnerability-advisories/#CVE-2021-34625
CVE ID: CVE-2021-34626 State: PUBLISHED Published: 2021-07-07T12:21:27.113332Z Last Updated: 2024-09-16T16:58:03.185Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N) Vendors: WP Upload Restriction Products: WP Upload Restriction Problem Types: CWE-284 Description: A vulnerability in the deleteCustomType function of the WP Upload Restriction WordPress plugin allows low-level authenticated users to delete custom extensions added by administrators. This issue affects versions 2.2.3 and prior. Additional Analyst Notes: - CVE Program Container: References: - https://www.wordfence.com/vulnerability-advisories/#CVE-2021-34626
CVE ID: CVE-2021-34627 State: PUBLISHED Published: 2021-07-07T12:21:32.490277Z Last Updated: 2024-09-16T18:54:22.361Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) Vendors: WP Upload Restriction Products: WP Upload Restriction Problem Types: CWE-284 Description: A vulnerability in the getSelectedMimeTypesByRole function of the WP Upload Restriction WordPress plugin allows low-level authenticated users to view custom extensions added by administrators. This issue affects versions 2.2.3 and prior. Additional Analyst Notes: - CVE Program Container: References: - https://www.wordfence.com/vulnerability-advisories/#CVE-2021-34627
CVE ID: CVE-2021-34628 State: PUBLISHED Published: 2021-08-02T20:39:16.497619Z Last Updated: 2024-09-16T22:24:48.262Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: Weblizar Products: Admin Custom Login Problem Types: CWE-352 Description: The Admin Custom Login WordPress plugin is vulnerable to Cross-Site Request Forgery due to the loginbgSave action found in the ~/includes/Login-form-setting/Login-form-background.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 3.2.7. Additional Analyst Notes: - CVE Program Container: References: - https://www.wordfence.com/vulnerability-advisories/#CVE-2021-34628 - https://plu
- CVE Program Container: References: - https://www.wordfence.com/vulnerability-advisories/#CVE-2021-34628 - https://plugins.trac.wordpress.org/browser/admin-custom-login/tags/3.2.7/includes/login-form-setting/login-form-background.php#L686
CVE ID: CVE-2021-34629 State: PUBLISHED Published: 2021-07-30T20:44:48.031144Z Last Updated: 2024-09-16T19:24:25.678Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) Vendors: SendGrid Products: SendGrid Problem Types: CWE-862 Description: The SendGrid WordPress plugin is vulnerable to authorization bypass via the get_ajax_statistics function found in the ~/lib/class-sendgrid-statistics.php file which allows authenticated users to export statistic for a WordPress multi-site main site, in versions up to and including 1.11.8. Additional Analyst Notes: - CVE Program Container: References: - https://www.wordfence.com/vulnerability-advisories/#CVE-2021-34629
CVE ID: CVE-2021-34630 State: PUBLISHED Published: 2021-07-30T20:45:07.508762Z Last Updated: 2024-09-17T01:15:37.501Z Severity: MEDIUM (CVSS 5 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:L) Vendors: Translate AI Multilingual Solutions Products: GTranslate Pro and GTranslate Enterprise Problem Types: CWE-116 Description: In the Pro and Enterprise versions of GTranslate < 2.8.65, the gtranslate_request_uri_var function runs at the top of all pages and echoes out the contents of $_SERVER['REQUEST_URI']. Although this uses addslashes, and most modern browsers automatically URLencode requests, this plugin is still vulnerable to Reflected XSS in older browsers such as Internet Explorer 9 or below,
code requests, this plugin is still vulnerable to Reflected XSS in older browsers such as Internet Explorer 9 or below, or in cases where an attacker is able to modify the request en route between the client and the server, or in cases where the user is using an atypical browsing solution. Additional Analyst Notes: - CVE Program Container: References: - https://plugins.svn.wordpress.org/gtranslate/tags/2.8.64/gtranslate.php
CVE ID: CVE-2021-34631 State: PUBLISHED Published: 2021-08-05T19:36:40.504718Z Last Updated: 2024-09-17T02:15:47.427Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: NewsPlugin Products: NewsPlugin Problem Types: CWE-352 Description: The NewsPlugin WordPress plugin is vulnerable to Cross-Site Request Forgery via the handle_save_style function found in the ~/news-plugin.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 1.0.18. Additional Analyst Notes: - CVE Program Container: References: - https://www.wordfence.com/vulnerability-advisories/#CVE-2021-34631
CVE ID: CVE-2021-34632 State: PUBLISHED Published: 2021-08-02T20:39:25.040571Z Last Updated: 2024-09-17T00:31:14.351Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: SEO Backlinks Products: SEO Backlinks Problem Types: CWE-352 Description: The SEO Backlinks WordPress plugin is vulnerable to Cross-Site Request Forgery via the loc_config function found in the ~/seo-backlinks.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 4.0.1. Additional Analyst Notes: - CVE Program Container: References: - https://www.wordfence.com/vulnerability-advisories/#CVE-2021-34632 - https://plugins.trac.wordpress.org/browser/seo-backlin
ps://www.wordfence.com/vulnerability-advisories/#CVE-2021-34632 - https://plugins.trac.wordpress.org/browser/seo-backlinks/trunk/seo-backlinks.php#L75
CVE ID: CVE-2021-34633 State: PUBLISHED Published: 2021-08-05T20:14:00.655388Z Last Updated: 2024-09-16T16:58:21.114Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: Youtube Feeder Products: Youtube Feeder Problem Types: CWE-352 Description: The Youtube Feeder WordPress plugin is vulnerable to Cross-Site Request Forgery via the printAdminPage function found in the ~/youtube-feeder.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 2.0.1. Additional Analyst Notes: - CVE Program Container: References: - https://plugins.trac.wordpress.org/browser/youtube-feeder/trunk/youtube-feeder.php#L669 - https://www.wordfence.com
s: - https://plugins.trac.wordpress.org/browser/youtube-feeder/trunk/youtube-feeder.php#L669 - https://www.wordfence.com/vulnerability-advisories/#CVE-2021-34633
CVE ID: CVE-2021-34634 State: PUBLISHED Published: 2021-08-05T20:13:56.348659Z Last Updated: 2024-09-17T01:16:37.350Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: SolaPlugins Products: Nifty Newsletters Problem Types: CWE-352 Description: The Nifty Newsletters WordPress plugin is vulnerable to Cross-Site Request Forgery via the sola_nl_wp_head function found in the ~/sola-newsletters.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 4.0.23. Additional Analyst Notes: - CVE Program Container: References: - https://plugins.trac.wordpress.org/browser/sola-newsletters/trunk/sola-newsletters.php#L774 - https://www.wo
ferences: - https://plugins.trac.wordpress.org/browser/sola-newsletters/trunk/sola-newsletters.php#L774 - https://www.wordfence.com/vulnerability-advisories/#CVE-2021-34634
CVE ID: CVE-2021-34635 State: PUBLISHED Published: 2021-08-02T20:39:20.859599Z Last Updated: 2024-09-17T02:51:45.027Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: AYS Pro Extensions Products: Poll Maker Problem Types: CWE-79 Description: The Poll Maker WordPress plugin is vulnerable to Reflected Cross-Site Scripting via the mcount parameter found in the ~/admin/partials/settings/poll-maker-settings.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 3.2.8. Additional Analyst Notes: - CVE Program Container: References: - https://www.wordfence.com/vulnerability-advisories/#CVE-2021-34635 - https://plugins.trac.wo
am Container: References: - https://www.wordfence.com/vulnerability-advisories/#CVE-2021-34635 - https://plugins.trac.wordpress.org/browser/poll-maker/tags/3.2.8/admin/partials/settings/poll-maker-settings.php#L249
CVE ID: CVE-2021-34636 State: PUBLISHED Published: 2021-09-28T13:53:30.212Z Last Updated: 2025-03-31T18:12:13.099Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: WpDevArt Products: Countdown and CountUp, WooCommerce Sales Timers Problem Types: CWE-352 Description: The Countdown and CountUp, WooCommerce Sales Timers WordPress plugin is vulnerable to Cross-Site Request Forgery via the save_theme function found in the ~/includes/admin/coundown_theme_page.php file due to a missing nonce check which allows attackers to inject arbitrary web scripts, in versions up to and including 1.5.7. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: Re
s, in versions up to and including 1.5.7. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/vulnerability-advisories/#CVE-2021-34636 - https://plugins.trac.wordpress.org/changeset/2605523/countdown-wpdevart-extended/trunk/includes/admin/coundown_theme_page.php
CVE ID: CVE-2021-34637 State: PUBLISHED Published: 2021-08-02T20:39:11.480689Z Last Updated: 2024-09-17T03:32:58.195Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: iTux Products: Post Index Problem Types: CWE-352 Description: The Post Index WordPress plugin is vulnerable to Cross-Site Request Forgery via the OptionsPage function found in the ~/php/settings.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 0.7.5. Additional Analyst Notes: - CVE Program Container: References: - https://www.wordfence.com/vulnerability-advisories/#CVE-2021-34637 - https://plugins.trac.wordpress.org/browser/post-index/trunk/php/setti
nce.com/vulnerability-advisories/#CVE-2021-34637 - https://plugins.trac.wordpress.org/browser/post-index/trunk/php/settings.php#L86
CVE ID: CVE-2021-34638 State: PUBLISHED Published: 2021-08-05T20:18:33 Last Updated: 2024-08-04T00:19:47.463Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) Vendors: W3 Eden, Inc. Products: WordPress Download Manager Problem Types: CWE-22, CWE-79, CWE-540 Description: Authenticated Directory Traversal in WordPress Download Manager <= 3.1.24 allows authenticated (Contributor+) users to obtain sensitive configuration file information, as well as allowing Author+ users to perform XSS attacks, by setting Download template to a file containing configuration information or an uploaded JavaScript with an image extension This issue affects: WordPress Download Manager versio
tion information or an uploaded JavaScript with an image extension This issue affects: WordPress Download Manager version 3.1.24 and prior versions. Additional Analyst Notes: - CVE Program Container: References: - https://www.wordfence.com/blog/2021/07/wordpress-download-manager-vulnerabilities/
CVE ID: CVE-2021-34639 State: PUBLISHED Published: 2021-08-05T20:18:29 Last Updated: 2024-08-04T00:19:47.285Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: W3 Eden, Inc. Products: WordPress Download Manager Problem Types: CWE-646 Description: Authenticated File Upload in WordPress Download Manager <= 3.1.24 allows authenticated (Author+) users to upload files with a double extension, e.g. "payload.php.png" which is executable in some configurations. This issue affects: WordPress Download Manager version 3.1.24 and prior versions. Additional Analyst Notes: - CVE Program Container: References: - https://www.wordfence.com/blog/2021/07/wordpress-download-manager
Analyst Notes: - CVE Program Container: References: - https://www.wordfence.com/blog/2021/07/wordpress-download-manager-vulnerabilities/
CVE ID: CVE-2021-34640 State: PUBLISHED Published: 2021-08-11T15:00:01.135Z Last Updated: 2025-05-23T20:10:32.777Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: Securimage-WP-Fixed Products: Securimage-WP-Fixed Problem Types: CWE-79 Description: The Securimage-WP-Fixed WordPress plugin is vulnerable to Reflected Cross-Site Scripting due to the use of $_SERVER['PHP_SELF'] in the ~/securimage-wp.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 3.5.4. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://plugins.trac.wordpress.org/browser/securimage-wp-fixed/trunk/secu
tainer: - CISA ADP Vulnrichment: References: - https://plugins.trac.wordpress.org/browser/securimage-wp-fixed/trunk/securimage-wp.php#L628 - https://www.wordfence.com/vulnerability-advisories/#CVE-2021-34640
CVE ID: CVE-2021-34641 State: PUBLISHED Published: 2021-08-16T18:47:57.481Z Last Updated: 2025-05-05T18:16:21.403Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: SEOPress Products: SEOPress Problem Types: CWE-79 Description: The SEOPress WordPress plugin is vulnerable to Stored Cross-Site-Scripting via the processPut function found in the ~/src/Actions/Api/TitleDescriptionMeta.php file which allows authenticated attackers to inject arbitrary web scripts, in versions 5.0.0 - 5.0.3. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/blog/2021/08/xss-vulnerability-patched-in-seopress-affects-1000
DP Vulnrichment: References: - https://www.wordfence.com/blog/2021/08/xss-vulnerability-patched-in-seopress-affects-100000-sites/ - https://plugins.trac.wordpress.org/browser/wp-seopress/tags/5.0.4/src/Actions/Api/TitleDescriptionMeta.php#L78
CVE ID: CVE-2021-34642 State: PUBLISHED Published: 2021-08-16T18:22:23.199Z Last Updated: 2025-05-05T18:49:34.310Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: Followistic Products: Smart Email Alerts Problem Types: CWE-79 Description: The Smart Email Alerts WordPress plugin is vulnerable to Reflected Cross-Site Scripting via the api_key in the ~/views/settings.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 1.0.10. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/vulnerability-advisories/#CVE-2021-34642 - https://plugins.trac.wordpress.org/
: References: - https://www.wordfence.com/vulnerability-advisories/#CVE-2021-34642 - https://plugins.trac.wordpress.org/browser/smart-email-alerts/trunk/views/settings.php#L38
CVE ID: CVE-2021-34643 State: PUBLISHED Published: 2021-08-16T18:22:15.872Z Last Updated: 2025-05-05T18:50:41.251Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: Skaut Bazar Products: Skaut Bazar Problem Types: CWE-79 Description: The Skaut bazar WordPress plugin is vulnerable to Reflected Cross-Site Scripting due to the use of $_SERVER['PHP_SELF'] in the ~/skaut-bazar.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 1.3.2. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/vulnerability-advisories/#CVE-2021-34643 - https://plugins.trac.wordpress
hment: References: - https://www.wordfence.com/vulnerability-advisories/#CVE-2021-34643 - https://plugins.trac.wordpress.org/browser/skaut-bazar/tags/1.3.2/skaut-bazar.php#L657
CVE ID: CVE-2021-34644 State: PUBLISHED Published: 2021-08-16T18:22:21.137Z Last Updated: 2025-05-05T18:49:48.538Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: Multiplayer Games Products: Multiplayer Games Problem Types: CWE-79 Description: The Multiplayer Games WordPress plugin is vulnerable to Reflected Cross-Site Scripting due to the use of $_SERVER['PHP_SELF'] in the ~/multiplayergames.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 3.7. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/vulnerability-advisories/#CVE-2021-34644 - https://p
r: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/vulnerability-advisories/#CVE-2021-34644 - https://plugins.trac.wordpress.org/browser/multiplayer-plugin/trunk/multiplayergames.php#L662
CVE ID: CVE-2021-34645 State: PUBLISHED Published: 2021-08-19T15:25:44.786Z Last Updated: 2025-05-05T14:53:02.055Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: WP EasyCart Products: Shopping Cart & eCommerce Store Problem Types: CWE-352 Description: The Shopping Cart & eCommerce Store WordPress plugin is vulnerable to Cross-Site Request Forgery via the save_currency_settings function found in the ~/admin/inc/wp_easycart_admin_initial_setup.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 5.1.0. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://plugins.trac.wordpr
0. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://plugins.trac.wordpress.org/browser/wp-easycart/trunk/admin/inc/wp_easycart_admin_initial_setup.php?rev=2463792#L240 - https://wordfence.com/vulnerability-advisories/#CVE-2021-34645
CVE ID: CVE-2021-34646 State: PUBLISHED Published: 2021-08-30T18:03:51.937Z Last Updated: 2025-05-05T14:51:45.378Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Pluggabl LLC Products: Booster for WooCommcerce Problem Types: CWE-290 Description: Versions up to, and including, 5.4.3, of the Booster for WooCommerce WordPress plugin are vulnerable to authentication bypass via the process_email_verification function due to a random token generation weakness in the reset_and_mail_activation_link function found in the ~/includes/class-wcj-emails-verification.php file. This allows attackers to impersonate users and trigger an email address verification for arbit