Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2021-24174 State: PUBLISHED Published: 2021-04-05T18:27:44 Last Updated: 2024-08-03T19:21:18.712Z Vendors: Unknown Products: Database Backups Problem Types: CWE-352 Description: The Database Backups WordPress plugin through 1.2.2.6 does not have CSRF checks, allowing attackers to make a logged in user unwanted actions, such as generate backups of the database, change the plugin's settings and delete backups. Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/350c3e9a-bcc2-486a-90e6-d1dc13ce1bd5 - http://packetstormsecurity.com/files/163091/WordPress-Database-Backups-1.2.2.6-Cross-Site-Request-Forgery.html
CVE ID: CVE-2021-24175 State: PUBLISHED Published: 2021-04-05T18:27:44 Last Updated: 2024-08-03T19:21:18.637Z Vendors: Unknown Products: The Plus Addons for Elementor Page Builder Problem Types: CWE-287 Description: The Plus Addons for Elementor Page Builder WordPress plugin before 4.1.7 was being actively exploited to by malicious actors to bypass authentication, allowing unauthenticated users to log in as any user (including admin) by just providing the related username, as well as create accounts with arbitrary roles, such as admin. These issues can be exploited even if registration is disabled, and the Login widget is not active. Additional Analyst Notes: - CVE Program Container: Referen
registration is disabled, and the Login widget is not active. Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/c311feef-7041-4c21-9525-132b9bd32f89 - https://www.wordfence.com/blog/2021/03/critical-0-day-in-the-plus-addons-for-elementor-allows-site-takeover/ - https://posimyth.ticksy.com/ticket/2713734/
CVE ID: CVE-2021-24176 State: PUBLISHED Published: 2021-04-05T18:27:44 Last Updated: 2024-08-03T19:21:18.783Z Vendors: Unknown Products: JH 404 Logger Problem Types: CWE-79 Description: The JH 404 Logger WordPress plugin through 1.1 doesn't sanitise the referer and path of 404 pages, when they are output in the dashboard, which leads to executing arbitrary JavaScript code in the WordPress dashboard. Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/705bcd6e-6817-4f89-be37-901a767b0585 - https://ganofins.com/blog/my-first-cve-2021-24176/
CVE ID: CVE-2021-24177 State: PUBLISHED Published: 2021-04-05T18:27:45 Last Updated: 2024-08-03T19:21:18.692Z Vendors: Unknown Products: File Manager Problem Types: CWE-79 Description: In the default configuration of the File Manager WordPress plugin before 7.1, a Reflected XSS can occur on the endpoint /wp-admin/admin.php?page=wp_file_manager_properties when a payload is submitted on the User-Agent parameter. The payload is then reflected back on the web application response. Additional Analyst Notes: - CVE Program Container: References: - https://n4nj0.github.io/advisories/wordpress-plugin-wp-file-manager-i/ - https://wpscan.com/vulnerability/1cf3d256-cf4b-4d1f-9ed8-e2cc6392d8d8 - https://
s/wordpress-plugin-wp-file-manager-i/ - https://wpscan.com/vulnerability/1cf3d256-cf4b-4d1f-9ed8-e2cc6392d8d8 - https://plugins.trac.wordpress.org/changeset/2476829/
CVE ID: CVE-2021-24178 State: PUBLISHED Published: 2021-05-05T18:39:42 Last Updated: 2024-08-03T19:21:18.713Z Vendors: Business Directory Team Products: Business Directory Plugin – Easy Listing Directories for WordPress Problem Types: CWE-352 Description: The Business Directory Plugin – Easy Listing Directories for WordPress WordPress plugin before 5.11.1 suffered from Cross-Site Request Forgery issues, allowing an attacker to make a logged in administrator add, edit or delete form fields, which could also lead to Stored Cross-Site Scripting issues. Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/700f3b04-8298-447c-8d3c-4581880a63b5
CVE ID: CVE-2021-24179 State: PUBLISHED Published: 2021-05-05T18:39:42 Last Updated: 2024-08-03T19:21:18.652Z Vendors: Business Directory Team Products: Business Directory Plugin – Easy Listing Directories for WordPress Problem Types: CWE-352 Description: The Business Directory Plugin – Easy Listing Directories for WordPress WordPress plugin before 5.11 suffered from a Cross-Site Request Forgery issue, allowing an attacker to make a logged in administrator import files. As the plugin also did not validate uploaded files, it could lead to RCE. Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/c0a5cdde-732a-432a-86c2-776df5d130a7
CVE ID: CVE-2021-24180 State: PUBLISHED Published: 2021-04-05T18:27:45 Last Updated: 2024-08-03T19:21:18.675Z Vendors: Unknown Products: Related Posts for WordPress Problem Types: CWE-79 Description: Unvalidated input and lack of output encoding within the Related Posts for WordPress plugin before 2.0.4 lead to a Reflected Cross-Site Scripting (XSS) vulnerability within the 'lang' GET parameter while editing a post, triggered when users with the capability of editing posts access a malicious URL. Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/7593d5c8-cbc2-4469-b36b-5d4fb6d49718
CVE ID: CVE-2021-24181 State: PUBLISHED Published: 2021-04-05T18:27:45 Last Updated: 2024-08-03T19:21:18.715Z Vendors: Unknown Products: Tutor LMS – eLearning and online course solution Problem Types: CWE-89 Description: The tutor_mark_answer_as_correct AJAX action from the Tutor LMS – eLearning and online course solution WordPress plugin before 1.7.7 was vulnerable to blind and time based SQL injections that could be exploited by students. Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/d5a00322-7098-4f8d-8e5e-157b63449c17 - https://www.wordfence.com/blog/2021/03/several-vulnerabilities-patched-in-tutor-lms-plugin/
CVE ID: CVE-2021-24182 State: PUBLISHED Published: 2021-04-05T18:27:45 Last Updated: 2024-08-03T19:21:18.774Z Vendors: Unknown Products: Tutor LMS – eLearning and online course solution Problem Types: CWE-89 Description: The tutor_quiz_builder_get_answers_by_question AJAX action from the Tutor LMS – eLearning and online course solution WordPress plugin before 1.8.3 was vulnerable to UNION based SQL injection that could be exploited by students. Additional Analyst Notes: - CVE Program Container: References: - https://www.wordfence.com/blog/2021/03/several-vulnerabilities-patched-in-tutor-lms-plugin/ - https://wpscan.com/vulnerability/f74dfc52-46ba-41e3-994b-23115a22984f
CVE ID: CVE-2021-24183 State: PUBLISHED Published: 2021-04-05T18:27:45 Last Updated: 2024-08-03T19:21:18.708Z Vendors: Unknown Products: Tutor LMS – eLearning and online course solution Problem Types: CWE-89 Description: The tutor_quiz_builder_get_question_form AJAX action from the Tutor LMS – eLearning and online course solution WordPress plugin before 1.8.3 was vulnerable to UNION based SQL injection that could be exploited by students. Additional Analyst Notes: - CVE Program Container: References: - https://www.wordfence.com/blog/2021/03/several-vulnerabilities-patched-in-tutor-lms-plugin/ - https://wpscan.com/vulnerability/9b8da6b7-f1d6-4a7d-a621-4ca01e4b7496
CVE ID: CVE-2021-24184 State: PUBLISHED Published: 2021-04-05T18:27:45 Last Updated: 2024-08-03T19:21:18.926Z Vendors: Unknown Products: Tutor LMS – eLearning and online course solution Problem Types: CWE-862 Description: Several AJAX endpoints in the Tutor LMS – eLearning and online course solution WordPress plugin before 1.7.7 were unprotected, allowing students to modify course information and elevate their privileges among many other actions. Additional Analyst Notes: - CVE Program Container: References: - https://www.wordfence.com/blog/2021/03/several-vulnerabilities-patched-in-tutor-lms-plugin/ - https://wpscan.com/vulnerability/5e85917c-7a58-49cb-b8b3-05aa18ffff3e
CVE ID: CVE-2021-24185 State: PUBLISHED Published: 2021-04-05T18:27:45 Last Updated: 2024-08-03T19:21:18.658Z Vendors: Unknown Products: Tutor LMS – eLearning and online course solution Problem Types: CWE-89 Description: The tutor_place_rating AJAX action from the Tutor LMS – eLearning and online course solution WordPress plugin before 1.7.7 was vulnerable to blind and time based SQL injections that could be exploited by students. Additional Analyst Notes: - CVE Program Container: References: - https://www.wordfence.com/blog/2021/03/several-vulnerabilities-patched-in-tutor-lms-plugin/ - https://wpscan.com/vulnerability/0cba5349-e916-43f0-a1fe-62cf73e352a2
CVE ID: CVE-2021-24186 State: PUBLISHED Published: 2021-04-05T18:27:45 Last Updated: 2024-08-03T19:21:18.629Z Vendors: Unknown Products: Tutor LMS – eLearning and online course solution Problem Types: CWE-89 Description: The tutor_answering_quiz_question/get_answer_by_id function pair from the Tutor LMS – eLearning and online course solution WordPress plugin before 1.8.3 was vulnerable to UNION based SQL injection that could be exploited by students. Additional Analyst Notes: - CVE Program Container: References: - https://www.wordfence.com/blog/2021/03/several-vulnerabilities-patched-in-tutor-lms-plugin/ - https://wpscan.com/vulnerability/5f5c0c6c-6f76-4366-b590-0aab557f8c60
CVE ID: CVE-2021-24187 State: PUBLISHED Published: 2021-04-05T18:27:45 Last Updated: 2024-08-03T19:21:18.704Z Vendors: Unknown Products: SEO Redirection Plugin - 301 Redirect Manager Problem Types: CWE-79 Description: The setting page of the SEO Redirection Plugin - 301 Redirect Manager WordPress plugin before 6.4 is vulnerable to reflected Cross-Site Scripting (XSS) as user input is not properly sanitised before being output in an attribute. Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/c234700e-61dd-46a0-90fb-609e704269a9
CVE ID: CVE-2021-24188 State: PUBLISHED Published: 2021-05-14T11:38:15 Last Updated: 2024-08-03T19:21:18.967Z Vendors: wp-buy Products: WP Content Copy Protection & No Right Click Problem Types: CWE-285 Description: Low privileged users can use the AJAX action 'cp_plugins_do_button_job_later_callback' in the WP Content Copy Protection & No Right Click WordPress plugin before 3.1.5, to install any plugin (including a specific version) from the WordPress repository, as well as activate arbitrary plugin from then blog, which helps attackers install vulnerable plugins and could lead to more critical vulnerabilities like RCE. Additional Analyst Notes: - CVE Program Container: References: - https:
lead to more critical vulnerabilities like RCE. Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/74889e29-5349-43d1-baf5-1622493be90c
CVE ID: CVE-2021-24189 State: PUBLISHED Published: 2021-05-14T11:38:16 Last Updated: 2024-08-03T19:21:18.661Z Vendors: wp-buy Products: Captchinoo, Google recaptcha for admin login page Problem Types: CWE-285 Description: Low privileged users can use the AJAX action 'cp_plugins_do_button_job_later_callback' in the Captchinoo, Google recaptcha for admin login page WordPress plugin before 2.4, to install any plugin (including a specific version) from the WordPress repository, as well as activate arbitrary plugin from then blog, which helps attackers install vulnerable plugins and could lead to more critical vulnerabilities like RCE. Additional Analyst Notes: - CVE Program Container: References
and could lead to more critical vulnerabilities like RCE. Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/74889e29-5349-43d1-baf5-1622493be90c
CVE ID: CVE-2021-24190 State: PUBLISHED Published: 2021-05-14T11:38:16 Last Updated: 2024-08-03T19:21:18.665Z Vendors: wp-buy Products: WooCommerce Conditional Marketing Mailer Problem Types: CWE-285 Description: Low privileged users can use the AJAX action 'cp_plugins_do_button_job_later_callback' in the WooCommerce Conditional Marketing Mailer WordPress plugin before 1.5.2, to install any plugin (including a specific version) from the WordPress repository, as well as activate arbitrary plugin from then blog, which helps attackers install vulnerable plugins and could lead to more critical vulnerabilities like RCE. Additional Analyst Notes: - CVE Program Container: References: - https://wpsc
to more critical vulnerabilities like RCE. Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/74889e29-5349-43d1-baf5-1622493be90c
CVE ID: CVE-2021-24191 State: PUBLISHED Published: 2021-05-14T11:38:16 Last Updated: 2024-08-03T19:21:18.644Z Vendors: wp-buy Products: WP Maintenance Mode & Site Under Construction Problem Types: CWE-285 Description: Low privileged users can use the AJAX action 'cp_plugins_do_button_job_later_callback' in the WP Maintenance Mode & Site Under Construction WordPress plugin before 1.8.2, to install any plugin (including a specific version) from the WordPress repository, as well as activate arbitrary plugin from then blog, which helps attackers install vulnerable plugins and could lead to more critical vulnerabilities like RCE. Additional Analyst Notes: - CVE Program Container: References: - ht
ould lead to more critical vulnerabilities like RCE. Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/74889e29-5349-43d1-baf5-1622493be90c
CVE ID: CVE-2021-24192 State: PUBLISHED Published: 2021-05-14T11:38:16 Last Updated: 2024-08-03T19:21:18.686Z Vendors: wp-buy Products: Tree Sitemap (Pages, Posts & Categories list) Problem Types: CWE-285 Description: Low privileged users can use the AJAX action 'cp_plugins_do_button_job_later_callback' in the Tree Sitemap WordPress plugin before 2.9, to install any plugin (including a specific version) from the WordPress repository, as well as activate arbitrary plugin from then blog, which helps attackers install vulnerable plugins and could lead to more critical vulnerabilities like RCE. Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/7488
ilities like RCE. Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/74889e29-5349-43d1-baf5-1622493be90c
CVE ID: CVE-2021-24193 State: PUBLISHED Published: 2021-05-14T11:38:16 Last Updated: 2024-08-03T19:21:18.668Z Vendors: wp-buy Products: Visitor Traffic Real Time Statistics Problem Types: CWE-285 Description: Low privileged users can use the AJAX action 'cp_plugins_do_button_job_later_callback' in the Visitor Traffic Real Time Statistics WordPress plugin before 2.12, to install any plugin (including a specific version) from the WordPress repository, as well as activate arbitrary plugin from then blog, which helps attackers install vulnerable plugins and could lead to more critical vulnerabilities like RCE. Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vu
ritical vulnerabilities like RCE. Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/74889e29-5349-43d1-baf5-1622493be90c
CVE ID: CVE-2021-24194 State: PUBLISHED Published: 2021-05-14T11:38:16 Last Updated: 2024-08-03T19:21:18.641Z Vendors: wp-buy Products: Login Protection – Limit Failed Login Attempts Problem Types: CWE-285 Description: Low privileged users can use the AJAX action 'cp_plugins_do_button_job_later_callback' in the Login Protection - Limit Failed Login Attempts WordPress plugin before 2.9, to install any plugin (including a specific version) from the WordPress repository, as well as activate arbitrary plugin from then blog, which helps attackers install vulnerable plugins and could lead to more critical vulnerabilities like RCE. Additional Analyst Notes: - CVE Program Container: References: - ht
CVE ID: CVE-2021-24195 State: PUBLISHED Published: 2021-05-14T11:38:16 Last Updated: 2024-08-03T19:21:18.812Z Vendors: wp-buy Products: Login as User or Customer (User Switching) Problem Types: CWE-285 Description: Low privileged users can use the AJAX action 'cp_plugins_do_button_job_later_callback' in the Login as User or Customer (User Switching) WordPress plugin before 1.8, to install any plugin (including a specific version) from the WordPress repository, as well as activate arbitrary plugin from then blog, which helps attackers install vulnerable plugins and could lead to more critical vulnerabilities like RCE. Additional Analyst Notes: - CVE Program Container: References: - https://wp
d to more critical vulnerabilities like RCE. Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/74889e29-5349-43d1-baf5-1622493be90c
CVE ID: CVE-2021-24196 State: PUBLISHED Published: 2021-04-05T18:27:45 Last Updated: 2024-08-03T19:21:18.781Z Vendors: Unknown Products: Social Slider Widget Problem Types: CWE-79 Description: The Social Slider Widget WordPress plugin before 1.8.5 allowed Authenticated Reflected XSS in the plugin settings page as the ‘token_error’ parameter can be controlled by users and it is directly echoed without being sanitized Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/bb20d732-a5e4-4140-ab51-b2aa1a53db12 - https://purinechu.github.io/posts/social_slider_widget_reflected_xss/
CVE ID: CVE-2021-24197 State: PUBLISHED Published: 2021-04-12T13:58:04 Last Updated: 2024-08-03T19:21:18.696Z Vendors: wpDataTables Products: wpDataTables – Tables & Table Charts Problem Types: CWE-284 Description: The wpDataTables – Tables & Table Charts premium WordPress plugin before 3.4.2 has Improper Access Control. A low privilege authenticated user that visits the page where the table is published can tamper the parameters to access the data of another user that are present in the same table by taking over the user permissions on the table through formdata[wdt_ID] parameter. By exploiting this issue an attacker is able to access and manage the data of all users in the same table. Addi
rameter. By exploiting this issue an attacker is able to access and manage the data of all users in the same table. Additional Analyst Notes: - CVE Program Container: References: - https://wpdatatables.com/help/whats-new-changelog/ - https://wpscan.com/vulnerability/a56c04a4-dda0-4a7f-a525-d0349a1fda2b - https://n4nj0.github.io/advisories/wordpress-plugin-wpdatatables-ii/
CVE ID: CVE-2021-24198 State: PUBLISHED Published: 2021-04-12T13:58:49 Last Updated: 2024-08-03T19:21:18.665Z Vendors: wpDataTables Products: wpDataTables – Tables & Table Charts Problem Types: CWE-284 Description: The wpDataTables – Tables & Table Charts premium WordPress plugin before 3.4.2 has Improper Access Control. A low privilege authenticated user that visits the page where the table is published can tamper the parameters to delete the data of another user that are present in the same table through id_key and id_val parameters. By exploiting this issue an attacker is able to delete the data of all users in the same table. Additional Analyst Notes: - CVE Program Container: References:
s able to delete the data of all users in the same table. Additional Analyst Notes: - CVE Program Container: References: - https://wpdatatables.com/help/whats-new-changelog/ - https://n4nj0.github.io/advisories/wordpress-plugin-wpdatatables-ii/ - https://wpscan.com/vulnerability/d953bc62-8a6f-445b-a556-bc25cdd200e3
CVE ID: CVE-2021-24199 State: PUBLISHED Published: 2021-04-12T13:59:17 Last Updated: 2024-08-03T19:21:18.723Z Vendors: wpDataTables Products: wpDataTables – Tables & Table Charts Problem Types: CWE-89 Description: The wpDataTables – Tables & Table Charts premium WordPress plugin before 3.4.2 allows a low privilege authenticated user to perform Boolean-based blind SQL Injection in the table list page on the endpoint /wp-admin/admin-ajax.php?action=get_wdtable&table_id=1, on the 'start' HTTP POST parameter. This allows an attacker to access all the data in the database and obtain access to the WordPress application. Additional Analyst Notes: - CVE Program Container: References: - https://wpdat
tain access to the WordPress application. Additional Analyst Notes: - CVE Program Container: References: - https://wpdatatables.com/help/whats-new-changelog/ - https://n4nj0.github.io/advisories/wordpress-plugin-wpdatatables-ii/ - https://wpscan.com/vulnerability/5c98c2d6-d002-4cff-9d6f-633cb3ec6280
CVE ID: CVE-2021-24200 State: PUBLISHED Published: 2021-04-12T13:59:38 Last Updated: 2024-08-03T19:21:18.669Z Vendors: wpDataTables Products: wpDataTables – Tables & Table Charts Problem Types: CWE-89 Description: The wpDataTables – Tables & Table Charts premium WordPress plugin before 3.4.2 allows a low privilege authenticated user to perform Boolean-based blind SQL Injection in the table list page on the endpoint /wp-admin/admin-ajax.php?action=get_wdtable&table_id=1, on the 'length' HTTP POST parameter. This allows an attacker to access all the data in the database and obtain access to the WordPress application. Additional Analyst Notes: - CVE Program Container: References: - https://wpda
btain access to the WordPress application. Additional Analyst Notes: - CVE Program Container: References: - https://wpdatatables.com/help/whats-new-changelog/ - https://n4nj0.github.io/advisories/wordpress-plugin-wpdatatables-ii/ - https://wpscan.com/vulnerability/21aa7e18-0162-45bf-a5c6-ceee64ffa1f9
CVE ID: CVE-2021-24201 State: PUBLISHED Published: 2021-04-05T18:27:46 Last Updated: 2024-08-03T19:21:18.669Z Vendors: Unknown Products: Elementor Website Builder Problem Types: CWE-79 Description: In the Elementor Website Builder WordPress plugin before 3.1.4, the column element (includes/elements/column.php) accepts an ‘html_tag’ parameter. Although the element control lists a fixed set of possible html tags, it is possible for a user with Contributor or above permissions to send a modified ‘save_builder’ request containing JavaScript in the ‘html_tag’ parameter, which is not filtered and is output without escaping. This JavaScript will then be executed when the saved page is viewed or pre
not filtered and is output without escaping. This JavaScript will then be executed when the saved page is viewed or previewed. Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/9647f516-b130-4cc8-85fb-2e69b034ced0 - https://www.wordfence.com/blog/2021/03/cross-site-scripting-vulnerabilities-in-elementor-impact-over-7-million-sites/
CVE ID: CVE-2021-24202 State: PUBLISHED Published: 2021-04-05T18:27:46 Last Updated: 2024-08-03T19:21:18.620Z Vendors: Unknown Products: Elementor Website Builder Problem Types: CWE-79 Description: In the Elementor Website Builder WordPress plugin before 3.1.4, the heading widget (includes/widgets/heading.php) accepts a ‘header_size’ parameter. Although the element control lists a fixed set of possible html tags, it is possible for a user with Contributor or above permissions to send a modified ‘save_builder’ request with this parameter set to ‘script’ and combined with a ‘title’ parameter containing JavaScript, which will then be executed when the saved page is viewed or previewed. Addition
title’ parameter containing JavaScript, which will then be executed when the saved page is viewed or previewed. Additional Analyst Notes: - CVE Program Container: References: - https://www.wordfence.com/blog/2021/03/cross-site-scripting-vulnerabilities-in-elementor-impact-over-7-million-sites/ - https://wpscan.com/vulnerability/b72bd13d-c8e2-4347-b009-542fc0fe21bb
CVE ID: CVE-2021-24203 State: PUBLISHED Published: 2021-04-05T18:27:46 Last Updated: 2024-08-03T19:21:18.671Z Vendors: Unknown Products: Elementor Website Builder Problem Types: CWE-79 Description: In the Elementor Website Builder WordPress plugin before 3.1.4, the divider widget (includes/widgets/divider.php) accepts an ‘html_tag’ parameter. Although the element control lists a fixed set of possible html tags, it is possible for a user with Contributor or above permissions to send a modified ‘save_builder’ request with this parameter set to ‘script’ and combined with a ‘text’ parameter containing JavaScript, which will then be executed when the saved page is viewed or previewed. Additional