Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2021-24391 State: PUBLISHED Published: 2021-09-06T11:09:20 Last Updated: 2024-08-03T19:28:23.814Z Vendors: Unknown Products: Cashtomer Problem Types: CWE-89 Description: An editid GET parameter of the Cashtomer WordPress plugin through 1.0.0 is not properly sanitised, escaped or validated before inserting to a SQL statement, leading to SQL injection. Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/0c26ee50-df3d-438a-93bb-faa88b7983af - https://codevigilant.com/disclosure/2021/wp-plugin-cashtomer/
CVE ID: CVE-2021-24392 State: PUBLISHED Published: 2021-09-06T11:09:21 Last Updated: 2024-08-03T19:28:23.803Z Vendors: Unknown Products: WordPress Membership SwiftCloud.io Problem Types: CWE-89 Description: An id GET parameter of the WordPress Membership SwiftCloud.io WordPress plugin through 1.0 is not properly sanitised, escaped or validated before inserting to a SQL statement, leading to SQL injection. Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/68530e63-bba3-4a9a-ae83-516684aa5dc6 - https://codevigilant.com/disclosure/2021/wp-plugin-club-management-software/
CVE ID: CVE-2021-24393 State: PUBLISHED Published: 2021-09-06T11:09:22 Last Updated: 2024-08-03T19:28:23.800Z Vendors: Unknown Products: Comment Highlighter Problem Types: CWE-89 Description: A c GET parameter of the Comment Highlighter WordPress plugin through 0.13 is not properly sanitised, escaped or validated before inserting to a SQL statement, leading to SQL injection. Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/24969766-19e3-47cd-b32c-6c3330651d1f - https://codevigilant.com/disclosure/2021/wp-plugin-comment-highlighter/
CVE ID: CVE-2021-24394 State: PUBLISHED Published: 2021-09-06T11:09:22 Last Updated: 2024-08-03T19:28:23.853Z Vendors: Unknown Products: Easy Testimonial Manager Problem Types: CWE-89 Description: An id GET parameter of the Easy Testimonial Manager WordPress plugin through 1.2.0 is not sanitised, escaped or validated before inserting to a SQL statement, leading to SQL injection Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/e0bc9251-cccc-4416-91b2-8395d89d8fb3 - https://codevigilant.com/disclosure/2021/wp-plugin-easy-testimonial-manager/
CVE ID: CVE-2021-24395 State: PUBLISHED Published: 2021-09-06T11:09:23 Last Updated: 2024-08-03T19:28:23.915Z Vendors: Unknown Products: Embed Youtube Video Problem Types: CWE-89 Description: The editid GET parameter of the Embed Youtube Video WordPress plugin through 1.0 is not sanitised, escaped or validated before inserting to a SQL statement, leading to SQL injection. Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/6cd9ebcf-e78f-4f97-a8f9-b7e4ceab66b7 - https://codevigilant.com/disclosure/2021/wp-plugin-embed-youtube-video/
CVE ID: CVE-2021-24396 State: PUBLISHED Published: 2021-09-20T10:05:58 Last Updated: 2024-08-03T19:28:23.858Z Vendors: Unknown Products: GSEOR – WordPress SEO Plugin Problem Types: CWE-89 Description: A pageid GET parameter of the GSEOR – WordPress SEO Plugin WordPress plugin through 1.3 is not sanitised, escaped or validated before inserting to a SQL statement, leading to SQL injection. Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/28687291-2369-49e0-8905-dc4359454830 - https://codevigilant.com/disclosure/2021/wp-plugin-gseor/
CVE ID: CVE-2021-24397 State: PUBLISHED Published: 2021-09-20T10:06:00 Last Updated: 2024-08-03T19:28:23.912Z Vendors: Unknown Products: MicroCopy Problem Types: CWE-89 Description: The edit functionality in the MicroCopy WordPress plugin through 1.1.0 makes a get request to fetch the related option. The id parameter used is not sanitised, escaped or validated before inserting to a SQL statement, leading to SQL injection. Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/2edab2b0-d4fd-4d50-aca0-2a1b7b37c23d - https://codevigilant.com/disclosure/2021/wp-plugin-microcopy/
CVE ID: CVE-2021-24398 State: PUBLISHED Published: 2021-09-20T10:06:02 Last Updated: 2024-08-03T19:28:23.799Z Vendors: Unknown Products: RESPONSIVE 3D SLIDER Problem Types: CWE-89 Description: The Add new scene functionality in the Responsive 3D Slider WordPress plugin through 1.2 uses an id parameter which is not sanitised, escaped or validated before being inserted to a SQL statement, leading to SQL injection. This is a time based SQLI and in the same function vulnerable parameter is passed twice so if we pass time as 5 seconds it takes 10 seconds to return since the query is ran twice. Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/e6fb22
y is ran twice. Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/e6fb2256-0214-4891-b4b7-e4371a1599a5 - https://codevigilant.com/disclosure/2021/wp-plugin-morpheus-slider/
CVE ID: CVE-2021-24399 State: PUBLISHED Published: 2021-09-20T10:06:03 Last Updated: 2024-08-03T19:28:23.861Z Vendors: Unknown Products: The Sorter Problem Types: CWE-89 Description: The check_order function of The Sorter WordPress plugin through 1.0 uses an `area_id` parameter which is not sanitised, escaped or validated before inserting to a SQL statement, leading to SQL injection. Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/f7af0795-f111-4acc-9b1e-63cae5862f8b - https://codevigilant.com/disclosure/2021/wp-plugin-the-sorter/
CVE ID: CVE-2021-24400 State: PUBLISHED Published: 2021-09-20T10:06:05 Last Updated: 2024-08-03T19:28:23.893Z Vendors: Unknown Products: Display Users Problem Types: CWE-89 Description: The Edit Role functionality in the Display Users WordPress plugin through 2.0.0 had an `id` parameter which is not sanitised, escaped or validated before inserting to a SQL statement, leading to SQL injection. Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/614cf338-c8cf-4570-ae83-4f79cbdcc9d5 - https://codevigilant.com/disclosure/2021/wp-plugin-wp-display-users/
CVE ID: CVE-2021-24401 State: PUBLISHED Published: 2021-09-20T10:06:07 Last Updated: 2024-08-03T19:28:24.002Z Vendors: Unknown Products: WP Domain Redirect Problem Types: CWE-89 Description: The Edit domain functionality in the WP Domain Redirect WordPress plugin through 1.0 has an `editid` parameter which is not sanitised, escaped or validated before inserting to a SQL statement, leading to SQL injection. Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/f9ae34a9-84c9-4d48-af6a-9e6c786f856e - https://codevigilant.com/disclosure/2021/wp-plugins-domain-redirect/
CVE ID: CVE-2021-24402 State: PUBLISHED Published: 2021-09-20T10:06:08 Last Updated: 2024-08-03T19:28:24.015Z Vendors: Unknown Products: WP iCommerce – the first interactive ecommerce for wordpress Problem Types: CWE-89 Description: The Orders functionality in the WP iCommerce WordPress plugin through 1.1.1 has an `order_id` parameter which is not sanitised, escaped or validated before inserting to a SQL statement, leading to SQL injection. The feature is available to low privilege users such as contributors Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/7840e664-907f-42d1-950d-8c919032b707 - https://codevigilant.com/disclosure/2021/wp-plugi
ttps://wpscan.com/vulnerability/7840e664-907f-42d1-950d-8c919032b707 - https://codevigilant.com/disclosure/2021/wp-plugin-wp-icommerce/
CVE ID: CVE-2021-24403 State: PUBLISHED Published: 2021-09-20T10:06:10 Last Updated: 2024-08-03T19:28:23.817Z Vendors: Unknown Products: WordPress Page Contact Problem Types: CWE-89 Description: The Orders functionality in the WordPress Page Contact plugin through 1.0 has an order_id parameter which is not sanitised, escaped or validated before inserting to a SQL statement, leading to SQL injection. The feature is available to low privilege users such as contributors Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/a87040c1-58fc-4bf7-8bfa-0b9712a62ba8 - https://codevigilant.com/disclosure/2021/wp-plugin-wpagecontact/
CVE ID: CVE-2021-24404 State: PUBLISHED Published: 2021-09-20T10:06:11 Last Updated: 2024-08-03T19:28:23.928Z Vendors: Unknown Products: WP-Board Problem Types: CWE-89 Description: The options.php file of the WP-Board WordPress plugin through 1.1 beta accepts a postid parameter which is not sanitised, escaped or validated before inserting to a SQL statement, leading to SQL injection. This is a time based SQLI and in the same function vulnerable parameter is passed twice so if we pass time as 5 seconds it takes 10 seconds to return since the query ran twice. Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/a86240e1-f064-4972-9f97-6b349fdd57f6 -
st Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/a86240e1-f064-4972-9f97-6b349fdd57f6 - https://codevigilant.com/disclosure/2021/wp-plugin-wp-board/
CVE ID: CVE-2021-24405 State: PUBLISHED Published: 2021-07-06T11:03:31 Last Updated: 2024-08-03T19:28:23.840Z Vendors: IZSoft Products: Easy Cookies Policy Problem Types: CWE-863 Description: The Easy Cookies Policy WordPress plugin through 1.6.2 is lacking any capability and CSRF check when saving its settings, allowing any authenticated users (such as subscriber) to change them. If users can't register, this can be done through CSRF. Furthermore, the cookie banner setting is not sanitised or validated before being output in all pages of the frontend and the backend settings one, leading to a Stored Cross-Site Scripting issue. Additional Analyst Notes: - CVE Program Container: References: -
gs one, leading to a Stored Cross-Site Scripting issue. Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/9157d6d2-4bda-4fcd-8192-363a63a51ff5 - http://packetstormsecurity.com/files/166543/WordPress-Easy-Cookie-Policy-1.6.2-Cross-Site-Scripting.html
CVE ID: CVE-2021-24406 State: PUBLISHED Published: 2021-07-06T11:03:32 Last Updated: 2024-08-03T19:28:23.971Z Vendors: gVectors Team Products: wpForo Forum Problem Types: CWE-601 Description: The wpForo Forum WordPress plugin before 1.9.7 did not validate the redirect_to parameter in the login form of the forum, leading to an open redirect issue after a successful login. Such issue could allow an attacker to induce a user to use a login URL redirecting to a website under their control and being a replica of the legitimate one, asking them to re-enter their credentials (which will then in the attacker hands) Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/v
h will then in the attacker hands) Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/a9284931-555b-4c96-86a3-09e1040b0388
CVE ID: CVE-2021-24407 State: PUBLISHED Published: 2021-07-06T11:03:33 Last Updated: 2024-08-03T19:28:23.812Z Vendors: TieLabs Products: Jannah Problem Types: CWE-79 Description: The Jannah WordPress theme before 5.4.5 did not properly sanitize the 'query' POST parameter in its tie_ajax_search AJAX action, leading to a Reflected Cross-site Scripting (XSS) vulnerability. Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/fba9f010-1202-4eea-a6f5-78865c084153
CVE ID: CVE-2021-24408 State: PUBLISHED Published: 2021-07-12T19:20:51 Last Updated: 2024-08-03T19:28:23.801Z Vendors: Jeff Starr Products: Prismatic Problem Types: CWE-79 Description: The Prismatic WordPress plugin before 2.8 does not sanitise or validate some of its shortcode parameters, allowing users with a role as low as Contributor to set Cross-Site payload in them. A post made by a contributor would still have to be approved by an admin to have the XSS trigger able in the frontend, however, higher privilege users, such as editor could exploit this without the need of approval, and even when the blog disallows the unfiltered_html capability. Additional Analyst Notes: - CVE Program Cont
approval, and even when the blog disallows the unfiltered_html capability. Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/51855853-e7bd-425f-802c-824209f4f84d
CVE ID: CVE-2021-24409 State: PUBLISHED Published: 2021-07-12T19:20:52 Last Updated: 2024-08-03T19:28:23.803Z Vendors: Jeff Starr Products: Prismatic Problem Types: CWE-79 Description: The Prismatic WordPress plugin before 2.8 does not escape the 'tab' GET parameter before outputting it back in an attribute, leading to a reflected Cross-Site Scripting issue which will be executed in the context of a logged in administrator Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/ae3cd3ed-aecd-4d8c-8a2b-2936aaaef0cf
CVE ID: CVE-2021-24410 State: PUBLISHED Published: 2021-08-16T10:48:19 Last Updated: 2024-08-03T19:28:24.002Z Vendors: Unknown Products: తెలుగు బైబిల్ వచనములు Problem Types: CWE-79, CWE-352 Description: The తెలుగు బైబిల్ వచనములు WordPress plugin through 1.0 is lacking any CSRF check when saving its settings and verses, and do not sanitise or escape them when outputting them back in the page. This could allow attackers to make a logged in admin change the settings, as well as add malicious verses containing JavaScript code in them, leading to Stored XSS issues Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/b47ea36e-f37c-4745-b750-31f5b91f543f
CVE ID: CVE-2021-24411 State: PUBLISHED Published: 2021-08-16T10:48:19 Last Updated: 2024-08-03T19:28:23.811Z Vendors: Unknown Products: Social Tape Problem Types: CWE-79, CWE-352 Description: The Social Tape WordPress plugin through 1.0 does not have CSRF checks in place when saving its settings, and do not sanitise or escape them before outputting them back in the page, leading to a stored Cross-Site Scripting issue via a CSRF attack Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/ebe7f625-67e1-4df5-a569-20526dd57b24
CVE ID: CVE-2021-24412 State: PUBLISHED Published: 2021-10-18T13:45:36 Last Updated: 2024-08-03T19:28:23.811Z Vendors: Unknown Products: Html5 Audio Player – Audio Player for WordPress Problem Types: CWE-79 Description: The Html5 Audio Player – Audio Player for WordPress plugin before 2.1.3 does not sanitise or validate the parameters from its shortcode, allowing users with a role as low as contributor to set Cross-Site Scripting payload in them which will be triggered in the page/s with the embed malicious shortcode Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/c4ed3e52-cbe0-46dc-ab43-65de78cfb225
CVE ID: CVE-2021-24413 State: PUBLISHED Published: 2021-10-18T13:45:38 Last Updated: 2024-08-03T19:28:23.838Z Vendors: Unknown Products: Easy Twitter Feed Problem Types: CWE-79 Description: The Easy Twitter Feed WordPress plugin before 1.2 does not sanitise or validate the parameters from its shortcode, allowing users with a role as low as contributor to set Cross-Site Scripting payload in them which will be triggered in the page/s with the embed malicious shortcode Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/ce6d17c3-6741-4c80-ab13-e1824960ae24
CVE ID: CVE-2021-24414 State: PUBLISHED Published: 2021-10-25T13:20:33 Last Updated: 2024-08-03T19:28:23.832Z Vendors: Unknown Products: Video Player for YouTube Problem Types: CWE-79 Description: The Video Player for YouTube WordPress plugin before 1.4 does not sanitise or validate the parameters from its shortcode, allowing users with a role as low as contributor to set Cross-Site Scripting payload in them which will be triggered in the page/s with the embed malicious shortcode Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/e20b805d-eb11-4702-9803-77de276000ac
CVE ID: CVE-2021-24415 State: PUBLISHED Published: 2021-10-18T13:45:40 Last Updated: 2024-08-03T19:28:24.017Z Vendors: Unknown Products: Polo Video Gallery – Best wordpress video gallery plugin Problem Types: CWE-79 Description: The Polo Video Gallery – Best wordpress video gallery plugin WordPress plugin through 1.2 does not sanitise or validate the parameters from its shortcode, allowing users with a role as low as contributor to set Cross-Site Scripting payload in them which will be triggered in the page/s with the embed malicious shortcode Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/fd312bfd-7c98-4682-877d-846442e9c6a2
CVE ID: CVE-2021-24416 State: PUBLISHED Published: 2021-10-18T13:45:41 Last Updated: 2024-08-03T19:28:23.956Z Vendors: Unknown Products: StreamCast – Radio Player for WordPress Problem Types: CWE-79 Description: The StreamCast – Radio Player for WordPress plugin before 2.1.1 does not sanitise or validate the parameters from its shortcode, allowing users with a role as low as contributor to set Cross-Site Scripting payload in them which will be triggered in the page/s with the embed malicious shortcode Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/260c7e2d-d48c-42d6-ae05-bad3f3bac01d
CVE ID: CVE-2021-24417 State: REJECTED Published: N/A Last Updated: 2022-12-30T00:00:00 Description: No description available.
CVE ID: CVE-2021-24418 State: PUBLISHED Published: 2021-07-12T19:20:53 Last Updated: 2024-08-03T19:28:23.840Z Vendors: Mark Senff Products: Smooth Scroll Page Up/Down Buttons Problem Types: CWE-79 Description: The Smooth Scroll Page Up/Down Buttons WordPress plugin through 1.4 does not properly sanitise and validate its psb_positioning settings, allowing high privilege users such as admin to set an XSS payload in it, which will be executed in all pages of the blog Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/1512bba9-89e2-493d-b85d-10c7acb903db - https://m0ze.ru/vulnerability/%5B2021-04-29%5D-%5BWordPress%5D-%5BCWE-79%5D-Smooth-Scroll-Page
-493d-b85d-10c7acb903db - https://m0ze.ru/vulnerability/%5B2021-04-29%5D-%5BWordPress%5D-%5BCWE-79%5D-Smooth-Scroll-Page-UpDown-Buttons-WordPress-Plugin-v1.4.txt
CVE ID: CVE-2021-24419 State: PUBLISHED Published: 2021-07-12T19:20:54 Last Updated: 2024-08-03T19:28:23.802Z Vendors: Unknown Products: WP YouTube Lyte Problem Types: CWE-79 Description: The WP YouTube Lyte WordPress plugin before 1.7.16 did not sanitise or escape its lyte_yt_api_key and lyte_notification settings before outputting them back in the page, allowing high privilege users to set XSS payload on them and leading to stored Cross-Site Scripting issues. Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/0eeff1ee-d11e-4d52-a032-5f5bd8a6a2d7 - https://m0ze.ru/vulnerability/%5B2021-05-03%5D-%5BWordPress%5D-%5BCWE-79%5D-WP-YouTube-Lyte-WordP
52-a032-5f5bd8a6a2d7 - https://m0ze.ru/vulnerability/%5B2021-05-03%5D-%5BWordPress%5D-%5BCWE-79%5D-WP-YouTube-Lyte-WordPress-Plugin-v1.7.15.txt
CVE ID: CVE-2021-24420 State: PUBLISHED Published: 2021-07-12T19:20:55 Last Updated: 2024-08-03T19:28:23.956Z Vendors: Unknown Products: Request a Quote Problem Types: CWE-79 Description: The Request a Quote WordPress plugin before 2.3.4 did not sanitise and escape some of its quote fields when adding/editing a quote as admin, leading to Stored Cross-Site scripting issues when the quote is output in the 'All Quotes" table. Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/426eafb1-0261-4e7e-8c70-75bf4c476f18
CVE ID: CVE-2021-24421 State: PUBLISHED Published: 2021-07-12T19:20:56 Last Updated: 2024-08-03T19:28:24.004Z Vendors: Unknown Products: WP JobSearch Problem Types: CWE-79 Description: The WP JobSearch WordPress plugin before 1.7.4 did not sanitise or escape multiple of its parameters from the my-resume page before outputting them in the page, allowing low privilege users to use JavaScript payloads in them and leading to a Stored Cross-Site Scripting issue Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/b378d36d-66d9-4373-a628-e379e4766375 - https://m0ze.ru/vulnerability/%5B2021-05-19%5D-%5BWordPress%5D-%5BCWE-79%5D-WP-JobSearch-WordPress-Plu
28-e379e4766375 - https://m0ze.ru/vulnerability/%5B2021-05-19%5D-%5BWordPress%5D-%5BCWE-79%5D-WP-JobSearch-WordPress-Plugin-v1.7.3.txt
CVE ID: CVE-2021-24423 State: PUBLISHED Published: 2022-01-24T08:00:45 Last Updated: 2024-08-03T19:28:23.809Z Vendors: Unknown Products: UpdraftPlus WordPress Backup Plugin Problem Types: CWE-79 Description: The UpdraftPlus WordPress Backup Plugin WordPress plugin before 1.6.59 does not sanitise its updraft_service settings, allowing high privilege users to set malicious JavaScript payload in it and leading to a Stored Cross-Site Scripting issue Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/541974d6-2df8-4497-9aee-afd3b9024102 - https://m0ze.ru/vulnerability/%5B2021-05-09%5D-%5BWordPress%5D-%5BCWE-79%5D-UpdraftPlus-WordPress-Plugin-v1.16.56
4102 - https://m0ze.ru/vulnerability/%5B2021-05-09%5D-%5BWordPress%5D-%5BCWE-79%5D-UpdraftPlus-WordPress-Plugin-v1.16.56.txt
CVE ID: CVE-2021-24424 State: PUBLISHED Published: 2021-07-12T19:20:57 Last Updated: 2024-08-03T19:28:23.976Z Vendors: Unknown Products: WP Reset – Most Advanced WordPress Reset Tool Problem Types: CWE-79 Description: The WP Reset – Most Advanced WordPress Reset Tool WordPress plugin before 1.90 did not sanitise or escape its extra_data parameter when creating a snapshot via the admin dashboard, leading to an authenticated Stored Cross-Site Scripting issue Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/90cf8f9d-4d37-405d-b161-239bdb281828 - https://m0ze.ru/vulnerability/%5B2021-05-26%5D-%5BWordPress%5D-%5BCWE-79%5D-WP-Reset-WordPress-Plugin-
61-239bdb281828 - https://m0ze.ru/vulnerability/%5B2021-05-26%5D-%5BWordPress%5D-%5BCWE-79%5D-WP-Reset-WordPress-Plugin-v1.86.txt
CVE ID: CVE-2021-24425 State: PUBLISHED Published: 2021-08-02T10:31:54 Last Updated: 2024-08-03T19:28:23.900Z Vendors: Unknown Products: Floating Notification Bar, Sticky Menu on Scroll, and Sticky Header for Any Theme – myStickymenu Problem Types: CWE-79 Description: The Floating Notification Bar, Sticky Menu on Scroll, and Sticky Header for Any Theme – myStickymenu WordPress plugin before 2.5.2 does not sanitise or escape its Bar Text settings, allowing hight privilege users to use malicious JavaScript in it, leading to a Stored Cross-Site Scripting issue, which will be triggered in the plugin's setting, as well as all front-page of the blog (when the Welcome bar is active) Additional Anal
riggered in the plugin's setting, as well as all front-page of the blog (when the Welcome bar is active) Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/14632fa8-597e-49ff-8583-9797208a3583 - https://m0ze.ru/vulnerability/%5B2021-05-21%5D-%5BWordPress%5D-%5BCWE-79%5D-MyStickymenu-WordPress-Plugin-v2.5.1.txt
CVE ID: CVE-2021-24426 State: PUBLISHED Published: 2021-07-12T19:20:58 Last Updated: 2024-08-03T19:28:23.844Z Vendors: Unknown Products: Backup by 10Web – Backup and Restore Plugin Problem Types: CWE-79 Description: The Backup by 10Web – Backup and Restore Plugin WordPress plugin through 1.0.20 does not sanitise or escape the tab parameter before outputting it back in the page, leading to a reflected Cross-Site Scripting issue Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/48464b3f-fe57-40fe-8868-398a36099fb9 - https://m0ze.ru/vulnerability/%5B2021-05-23%5D-%5BWordPress%5D-%5BCWE-79%5D-Backup-by-10Web-WordPress-Plugin-v1.0.20.txt