Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2021-24500 State: PUBLISHED Published: 2021-08-09T10:04:08 Last Updated: 2024-08-03T19:35:19.928Z Vendors: Unknown Products: Workreap Problem Types: CWE-283, CWE-284, CWE-862 Description: Several AJAX actions available in the Workreap WordPress theme before 2.2.2 lacked CSRF protections, as well as allowing insecure direct object references that were not validated. This allows an attacker to trick a logged in user to submit a POST request to the vulnerable site, potentially modifying or deleting arbitrary objects on the target site. Additional Analyst Notes: - CVE Program Container: References: - https://jetpack.com/2021/07/07/multiple-vulnerabilities-in-workreap-theme/ - https:/
VE Program Container: References: - https://jetpack.com/2021/07/07/multiple-vulnerabilities-in-workreap-theme/ - https://wpscan.com/vulnerability/0c4b5ecc-54d0-45ec-9f92-b2ca3cadbe56
CVE ID: CVE-2021-24501 State: PUBLISHED Published: 2021-08-09T10:04:09 Last Updated: 2024-08-03T19:35:19.963Z Vendors: Unknown Products: Workreap Problem Types: CWE-283, CWE-862 Description: The Workreap WordPress theme before 2.2.2 had several AJAX actions missing authorization checks to verify that a user was authorized to perform critical operations such as modifying or deleting objects. This allowed a logged in user to modify or delete objects belonging to other users on the site. Additional Analyst Notes: - CVE Program Container: References: - https://jetpack.com/2021/07/07/multiple-vulnerabilities-in-workreap-theme/ - https://wpscan.com/vulnerability/66e4aaf4-5ef7-4da8-a45c-e24f449c363
07/07/multiple-vulnerabilities-in-workreap-theme/ - https://wpscan.com/vulnerability/66e4aaf4-5ef7-4da8-a45c-e24f449c363e
CVE ID: CVE-2021-24502 State: PUBLISHED Published: 2021-08-09T10:04:10 Last Updated: 2024-08-03T19:35:19.913Z Vendors: Unknown Products: Maps Plugin using Google Maps for WordPress – WP Google Map Problem Types: CWE-79 Description: The WP Google Map WordPress plugin before 1.7.7 did not sanitise or escape the Map Title before outputting them in the page, leading to a Stored Cross-Site Scripting issue by high privilege users, even when the unfiltered_html capability is disallowed Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/f95c3a48-5228-4047-9b92-de985741d157 - https://drive.google.com/file/d/1CbBlsf0Vt1QLBTnSC-vod2UCMm_NnZ2p/view?usp=shar
y/f95c3a48-5228-4047-9b92-de985741d157 - https://drive.google.com/file/d/1CbBlsf0Vt1QLBTnSC-vod2UCMm_NnZ2p/view?usp=sharing
CVE ID: CVE-2021-24503 State: PUBLISHED Published: 2021-08-02T10:32:29 Last Updated: 2024-08-03T19:35:19.753Z Vendors: Unknown Products: Popular Brand Icons – Simple Icons Problem Types: CWE-79 Description: The Popular Brand Icons – Simple Icons WordPress plugin before 2.7.8 does not sanitise or validate some of its shortcode parameters, such as "color", "size" or "class", allowing users with a role as low as Contributor to set Cross-Site payload in them. A post made by a contributor would still have to be approved by an admin to have the XSS triggered in the frontend, however, higher privilege users, such as editor could exploit this without the need of approval, and even when the blog disa
ver, higher privilege users, such as editor could exploit this without the need of approval, and even when the blog disallows the unfiltered_html capability. Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/18ab1570-2b4a-48a4-86e6-c1d368563691
CVE ID: CVE-2021-24504 State: PUBLISHED Published: 2021-08-02T10:32:30 Last Updated: 2024-08-03T19:35:20.022Z Vendors: Unknown Products: WP LMS – Best WordPress LMS Plugin Problem Types: CWE-79, CWE-352 Description: The WP LMS – Best WordPress LMS Plugin WordPress plugin through 1.1.2 does not properly sanitise or validate its User Field Titles, allowing XSS payload to be used in them. Furthermore, no CSRF and capability checks were in place, allowing such attack to be performed either via CSRF or as any user (including unauthenticated) Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/e0182508-23f4-4bdb-a1ef-1d1be38f3ad1
CVE ID: CVE-2021-24505 State: PUBLISHED Published: 2021-08-09T10:04:11 Last Updated: 2024-08-03T19:35:19.880Z Vendors: Unknown Products: Forms Problem Types: CWE-79 Description: The Forms WordPress plugin before 1.12.3 did not sanitise its input fields, leading to Stored Cross-Site scripting issues. The plugin was vulnerable to an Authenticated Stored Cross-Site Scripting (XSS) vulnerability within the Forms "Add new" field. Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/550e08ac-4c3a-4e22-8e98-bc5bfc020ca9
CVE ID: CVE-2021-24506 State: PUBLISHED Published: 2021-08-23T11:09:58 Last Updated: 2024-08-03T19:35:19.850Z Vendors: Unknown Products: Slider Hero with Animation, Video Background & Intro Maker Problem Types: CWE-89 Description: The Slider Hero with Animation, Video Background & Intro Maker WordPress plugin before 8.2.7 does not sanitise or escape the id attribute of its hero-button shortcode before using it in a SQL statement, allowing users with a role as low as Contributor to perform SQL injection. Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/52c8755c-46b9-4383-8c8d-8816f03456b0
CVE ID: CVE-2021-24507 State: PUBLISHED Published: 2021-08-09T10:04:12 Last Updated: 2024-08-03T19:35:20.199Z Vendors: Unknown Products: Astra Pro Addon Problem Types: CWE-89 Description: The Astra Pro Addon WordPress plugin before 3.5.2 did not properly sanitise or escape some of the POST parameters from the astra_pagination_infinite and astra_shop_pagination_infinite AJAX action (available to both unauthenticated and authenticated user) before using them in SQL statement, leading to an SQL Injection issues Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/a1a0dc0b-c351-4d46-ac9b-b297ce4d251c - https://wpastra.com/changelog/astra-pro-addon/
CVE ID: CVE-2021-24508 State: PUBLISHED Published: 2021-09-13T17:56:20 Last Updated: 2024-08-03T19:35:19.732Z Vendors: Unknown Products: Smash Balloon Social Post Feed Problem Types: CWE-79 Description: The Smash Balloon Social Post Feed WordPress plugin before 2.19.2 does not sanitise or escape the feedID POST parameter in its feed_locator AJAX action (available to both authenticated and unauthenticated users) before outputting a truncated version of it in the admin dashboard, leading to an unauthenticated Stored Cross-Site Scripting issue which will be executed in the context of a logged in administrator. Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/v
text of a logged in administrator. Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/2b543740-d4b0-49b5-a021-454a3a72162f
CVE ID: CVE-2021-24509 State: PUBLISHED Published: 2021-08-09T10:04:13 Last Updated: 2024-08-03T19:35:20.036Z Vendors: Unknown Products: Page View Count Problem Types: CWE-79 Description: The Page View Count WordPress plugin before 2.4.9 does not escape the postid parameter of pvc_stats shortcode, allowing users with a role as low as Contributor to perform Stored XSS attacks. A post made by a contributor would still have to be approved by an admin to have the XSS triggered in the frontend, however, higher privilege users, such as editor could exploit this without the need of approval, and even when the blog disallows the unfiltered_html capability. Additional Analyst Notes: - CVE Program Con
f approval, and even when the blog disallows the unfiltered_html capability. Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/06df2729-21da-4c22-ae1e-dda1f15bdf8f
CVE ID: CVE-2021-24510 State: PUBLISHED Published: 2021-09-13T17:56:22 Last Updated: 2024-08-03T19:35:20.087Z Vendors: Unknown Products: MF Gig Calendar Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The MF Gig Calendar WordPress plugin before 1.2 does not sanitise and escape the id GET parameter before outputting back in the admin dashboard when editing an Event, leading to a reflected Cross-Site Scripting issue Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/715721b0-13a1-413a-864d-2380f38ecd39
CVE ID: CVE-2021-24511 State: PUBLISHED Published: 2021-09-20T10:06:13 Last Updated: 2024-08-03T19:35:20.158Z Vendors: Unknown Products: Product Feed on WooCommerce for Google, Awin, Shareasale, Bing, and More Problem Types: CWE-89 Description: The fetch_product_ajax functionality in the Product Feed on WooCommerce WordPress plugin before 3.3.1.0 uses a `product_id` POST parameter which is not properly sanitised, escaped or validated before inserting to a SQL statement, leading to SQL injection. Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/0fa114a0-29df-4312-9138-eb9f0aedb3c5 - https://codevigilant.com/disclosure/2021/wp-plugin-purple-xmls
.com/vulnerability/0fa114a0-29df-4312-9138-eb9f0aedb3c5 - https://codevigilant.com/disclosure/2021/wp-plugin-purple-xmls-google-product-feed-for-woocommerce/
CVE ID: CVE-2021-24512 State: PUBLISHED Published: 2021-08-16T10:48:23 Last Updated: 2024-08-03T19:35:19.773Z Vendors: Unknown Products: Video Posts Webcam Recorder Problem Types: CWE-79 Description: The Video Posts Webcam Recorder WordPress plugin before 3.2.4 has an authenticated reflected cross site scripting (XSS) vulnerability in one of the administrative functions for handling deletion of videos. Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/458a576e-a7ed-4758-a80c-cd08c370aaf4
CVE ID: CVE-2021-24513 State: PUBLISHED Published: 2021-09-06T11:09:25 Last Updated: 2024-08-03T19:35:19.766Z Vendors: Unknown Products: Form Builder | Create Responsive Contact Forms Problem Types: CWE-79 Description: The Form Builder | Create Responsive Contact Forms WordPress plugin before 1.9.8.4 does not sanitise or escape its Form Title, allowing high privilege users such as admin to set Cross-Site Scripting payload in them, even when the unfiltered_html capability is disallowed Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/a1dc0ea9-51dd-43c3-bfd9-c5106193aeb6
CVE ID: CVE-2021-24514 State: PUBLISHED Published: 2021-10-25T13:20:39 Last Updated: 2024-08-03T19:35:19.892Z Vendors: Unknown Products: Visual Form Builder Problem Types: CWE-79 Description: The Visual Form Builder WordPress plugin before 3.0.4 does not sanitise or escape its Form Name, allowing high privilege users such as admin to set Cross-Site Scripting payload in them, even when the unfiltered_html capability is disallowed Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/0afa78d3-2403-4e0c-8f16-5b7874b03cd2
CVE ID: CVE-2021-24515 State: PUBLISHED Published: 2021-10-25T13:20:41 Last Updated: 2024-08-03T19:35:20.135Z Vendors: Unknown Products: Video Gallery - Vimeo and YouTube Gallery Problem Types: CWE-79 Description: The Video Gallery WordPress plugin before 1.1.5 does not escape the Title and Description of the videos in a gallery before outputting them in attributes, leading to Stored Cross-Site Scripting issues Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/6bbea7fe-e966-406b-ad06-0206fcc6f0a0
CVE ID: CVE-2021-24516 State: PUBLISHED Published: 2021-10-18T13:45:43 Last Updated: 2024-08-03T19:35:20.061Z Vendors: Unknown Products: PlanSo Forms Problem Types: CWE-79 Description: The PlanSo Forms WordPress plugin through 2.6.3 does not escape the title of its Form before outputting it in attributes, allowing high privilege users such as admin to set XSS payload in it, even when the unfiltered_html is disallowed, leading to an Authenticated Stored Cross-Site Scripting issue. Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/88d70e35-4c22-4bc7-b1a5-24068d55257c
CVE ID: CVE-2021-24517 State: PUBLISHED Published: 2021-09-06T11:09:26 Last Updated: 2024-08-03T19:35:19.868Z Vendors: Unknown Products: Stop Spammers Security | Block Spam Users, Comments, Forms Problem Types: CWE-79 Description: The Stop Spammers Security | Block Spam Users, Comments, Forms WordPress plugin before 2021.18 does not escape some of its settings, allowing high privilege users such as admin to set Cross-Site Scripting payloads in them even when the unfiltered_html capability is disallowed Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/f440edd8-94fe-440a-8a5b-e3d24dcfcbc1
CVE ID: CVE-2021-24518 State: PUBLISHED Published: 2021-08-16T10:48:24 Last Updated: 2024-08-03T19:35:19.719Z Vendors: Unknown Products: WPFront Notification Bar Problem Types: CWE-79 Description: The WPFront Notification Bar WordPress plugin before 2.0.0.07176 does not sanitise or escape its Custom CSS setting, allowing high privilege users such as admin to set XSS payload in it even when the unfiltered_html capability is disallowed, leading to an authenticated Stored Cross-Site Scripting issue Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/53103cdc-a4bf-40fa-aeb1-790fc7a65f0a - https://packetstormsecurity.com/files/163472/
CVE ID: CVE-2021-24519 State: PUBLISHED Published: 2021-08-16T10:48:25 Last Updated: 2024-08-03T19:35:20.093Z Vendors: Unknown Products: VikRentCar Car Rental Management System Problem Types: CWE-79 Description: The VikRentCar Car Rental Management System WordPress plugin before 1.1.10 does not sanitise the 'Text Next to Icon' field when adding or editing a Characteristic, allowing high privilege users such as admin to use XSS payload in it, leading to an authenticated Stored Cross-Site Scripting issue Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/368828f9-fdd1-4a82-8658-20e0f4c4da0c
CVE ID: CVE-2021-24520 State: PUBLISHED Published: 2021-08-09T10:04:14 Last Updated: 2024-08-03T19:35:19.820Z Vendors: Unknown Products: Stock in & out Problem Types: CWE-89 Description: The Stock in & out WordPress plugin through 1.0.4 lacks proper sanitization before passing variables to an SQL request, making it vulnerable to SQL Injection attacks. Users with a role of contributor or higher can exploit this vulnerability. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/pang0lin/CVEproject/blob/main/wordpress_Stock-in-and-out_sqli.md - https://wpscan.com/vulnerability/f903aadd-17af-4ddf-8635-abb3338ac815
CVE ID: CVE-2021-24521 State: PUBLISHED Published: 2021-08-09T10:04:14 Last Updated: 2024-08-03T19:35:19.972Z Vendors: Unknown Products: Side Menu Lite – add sticky fixed buttons Problem Types: CWE-89 Description: The Side Menu Lite – add sticky fixed buttons WordPress plugin before 2.2.1 does not properly sanitize input values from the browser when building an SQL statement. Users with the administrator role or permission to manage this plugin could perform an SQL Injection attack. Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/eb21ebc5-265c-4378-b2c6-62f6bc2f69cd - https://github.com/pang0lin/CVEproject/blob/main/wordpress_side-menu-lite_s
ility/eb21ebc5-265c-4378-b2c6-62f6bc2f69cd - https://github.com/pang0lin/CVEproject/blob/main/wordpress_side-menu-lite_sqli.md
CVE ID: CVE-2021-24522 State: PUBLISHED Published: 2021-08-09T10:04:15 Last Updated: 2024-08-03T19:35:20.107Z Vendors: Unknown Products: User Registration, User Profile, Login & Membership – ProfilePress (Formerly WP User Avatar) Problem Types: CWE-79 Description: The User Registration, User Profile, Login & Membership – ProfilePress (Formerly WP User Avatar) WordPress plugin before 3.1.11's widget for tabbed login/register was not properly escaped and could be used in an XSS attack which could lead to wp-admin access. Further, the plugin in several places assigned $_POST as $_GET which meant that in some cases this could be replicated with just $_GET parameters and no need for $_POST values
s $_GET which meant that in some cases this could be replicated with just $_GET parameters and no need for $_POST values. Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/25b51add-197c-4aff-b1a8-b92fb11d8697
CVE ID: CVE-2021-24523 State: PUBLISHED Published: 2021-09-13T17:56:24 Last Updated: 2024-08-03T19:35:19.870Z Vendors: Unknown Products: Daily Prayer Time Problem Types: CWE-79 Description: The Daily Prayer Time WordPress plugin before 2021.08.10 does not sanitise or escape some of its settings before outputting them in the page, leading to Authenticated Stored Cross-Site Scripting issues. Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/832fe086-1d33-430b-bdb5-e444761576b2
CVE ID: CVE-2021-24524 State: PUBLISHED Published: 2021-08-23T11:09:59 Last Updated: 2024-08-03T19:35:20.023Z Vendors: Unknown Products: GiveWP – Donation Plugin and Fundraising Platform Problem Types: CWE-79 Description: The GiveWP – Donation Plugin and Fundraising Platform WordPress plugin before 2.12.0 did not escape the Donation Level setting of its Donation Forms, allowing high privilege users to use Cross-Site Scripting payloads in them. Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/5a4774ec-c0ee-4c6b-92a6-fa10821ec336
CVE ID: CVE-2021-24525 State: PUBLISHED Published: 2021-09-20T10:06:15 Last Updated: 2024-08-03T19:35:19.902Z Vendors: Unknown Products: WordPress Shortcodes Plugin — Shortcodes Ultimate Problem Types: CWE-79 Description: The Shortcodes Ultimate WordPress plugin before 5.10.2 allows users with Contributor roles to perform stored XSS via shortcode attributes. Note: the plugin is inconsistent in its handling of shortcode attributes; some do escape, most don't, and there are even some attributes that are insecure by design (like [su_button]'s onclick attribute). Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/7f5659bd-50c3-4725-95f4-cf88812acf1c
CVE ID: CVE-2021-24526 State: PUBLISHED Published: 2021-08-16T10:48:26 Last Updated: 2024-08-03T19:35:20.030Z Vendors: Unknown Products: Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder Problem Types: CWE-79 Description: The Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder WordPress plugin before 1.13.60 does not escape its Form Title before outputting it in an attribute when editing a form in the admin dashboard, leading to an authenticated Stored Cross-Site Scripting issue Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/17287d8a-ba27-42dc-9370-a931ef404995
CVE ID: CVE-2021-24527 State: PUBLISHED Published: 2021-08-16T10:48:27 Last Updated: 2024-08-03T19:35:19.893Z Vendors: Unknown Products: User Registration & User Profile – Profile Builder Problem Types: CWE-287 Description: The User Registration & User Profile – Profile Builder WordPress plugin before 3.4.9 has a bug allowing any user to reset the password of the admin of the blog, and gain unauthorised access, due to a bypass in the way the reset key is checked. Furthermore, the admin will not be notified of such change by email for example. Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/c142e738-bc4b-4058-a03e-1be6fca47207
CVE ID: CVE-2021-24528 State: PUBLISHED Published: 2021-08-30T14:11:20 Last Updated: 2024-08-03T19:35:20.114Z Vendors: Unknown Products: FluentSMTP – WordPress Mail SMTP, SES, SendGrid, Mailgun and Any SMTP Plugin Problem Types: CWE-79 Description: The FluentSMTP WordPress plugin before 2.0.1 does not sanitize parameters before storing the settings in the database, nor does the plugin escape the values before outputting them when viewing the SMTP settings set by this plugin, leading to a stored cross site scripting (XSS) vulnerability. Only users with roles capable of managing plugins can modify the plugin's settings. Additional Analyst Notes: - CVE Program Container: References: - https://w
ing plugins can modify the plugin's settings. Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/8b8d316b-96b2-4cdc-9da5-c9ea6108a85b
CVE ID: CVE-2021-24529 State: PUBLISHED Published: 2021-08-23T11:10:00 Last Updated: 2024-08-03T19:35:20.018Z Vendors: Unknown Products: Grid Gallery – Photo Image Grid Gallery Problem Types: CWE-79 Description: The Grid Gallery – Photo Image Grid Gallery WordPress plugin before 1.2.5 does not properly sanitize the title field for image galleries when adding them via the admin dashboard, resulting in an authenticated Stored Cross-Site Scripting vulnerability. Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/8953d931-19f9-4b73-991c-9c48db1af8b5
CVE ID: CVE-2021-24530 State: PUBLISHED Published: 2021-09-20T10:06:17 Last Updated: 2024-08-03T19:35:19.983Z Vendors: Unknown Products: Alojapro Widget Problem Types: CWE-79 Description: The Alojapro Widget WordPress plugin through 1.1.15 doesn't properly sanitise its Custom CSS settings, allowing high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/caf36ca5-aafd-48bd-a1e5-30f3973d8eb8
CVE ID: CVE-2021-24531 State: PUBLISHED Published: 2021-08-23T11:10:00 Last Updated: 2024-08-03T19:35:20.133Z Vendors: Unknown Products: Charitable – Donation Plugin Problem Types: CWE-79 Description: The Charitable – Donation Plugin WordPress plugin before 1.6.51 is affected by an authenticated stored cross-site scripting vulnerability which was found in the add donation feature. Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/a5837621-ee6e-4876-9f65-82658fc0341f - https://www.wpcharitable.com/release-notes-1-6-51/
CVE ID: CVE-2021-24533 State: PUBLISHED Published: 2021-08-23T11:10:01 Last Updated: 2024-08-03T19:35:19.939Z Vendors: Unknown Products: Maintenance Problem Types: CWE-79 Description: The Maintenance WordPress plugin before 4.03 does not sanitise or escape some of its settings, allowing high privilege users such as admin to se Cross-Site Scripting payload in them (even when the unfiltered_html capability is disallowed), which will be triggered in the frontend Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/174b2119-b806-4da4-a23d-c19b552c86cb
CVE ID: CVE-2021-24534 State: PUBLISHED Published: 2021-08-16T10:48:28 Last Updated: 2024-08-03T19:35:20.213Z Vendors: Unknown Products: PhoneTrack Meu Site Manager Problem Types: CWE-79 Description: The PhoneTrack Meu Site Manager WordPress plugin through 0.1 does not sanitise or escape its "php_id" setting before outputting it back in an attribute in the page, leading to a stored Cross-Site Scripting issue. Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/b968b9a1-67f3-4bef-a3d3-6e8942bb6570
CVE ID: CVE-2021-24535 State: PUBLISHED Published: 2021-08-16T10:48:29 Last Updated: 2024-08-03T19:35:20.179Z Vendors: Unknown Products: Light Messages Problem Types: CWE-79, CWE-352 Description: The Light Messages WordPress plugin through 1.0 is lacking CSRF check when updating it's settings, and is not sanitising its Message Content in them (even with the unfiltered_html disallowed). As a result, an attacker could make a logged in admin update the settings to arbitrary values, and set a Cross-Site Scripting payload in the Message Content. Depending on the options set, the XSS payload can be triggered either in the backend only (in the plugin's settings), or both frontend and backend. Addit