Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2021-24689 State: PUBLISHED Published: 2022-02-28T09:06:04 Last Updated: 2024-08-03T19:42:16.217Z Vendors: Unknown Products: Contact Forms – Drag & Drop Contact Form Builder Problem Types: CWE-22 Description: The Contact Forms - Drag & Drop Contact Form Builder WordPress plugin through 1.0.5 allows high privilege users to download arbitrary files from the web server via a path traversal attack Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/31824250-e0d4-4285-97fa-9880b363e075
CVE ID: CVE-2021-24690 State: PUBLISHED Published: 2021-10-11T10:45:41 Last Updated: 2024-08-03T19:42:16.133Z Vendors: Unknown Products: Chained Quiz Problem Types: CWE-79 Description: The Chained Quiz WordPress plugin before 1.2.7.2 does not properly sanitize or escape inputs in the plugin's settings. Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/b2f473b4-268c-48b7-95e8-0a8eeaa3fc28
CVE ID: CVE-2021-24691 State: PUBLISHED Published: 2021-10-11T10:45:42 Last Updated: 2024-08-03T19:42:16.107Z Vendors: Unknown Products: Quiz And Survey Master – Best Quiz, Exam and Survey Plugin for WordPress Problem Types: CWE-79 Description: The Quiz And Survey Master WordPress plugin before 7.3.2 does not escape the Quiz Url Slug setting before outputting it in some pages, which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/ecf6a082-b563-42c4-9d8c-3757aa6b696f
CVE ID: CVE-2021-24692 State: PUBLISHED Published: 2022-03-14T14:40:54 Last Updated: 2024-08-03T19:42:16.158Z Vendors: Unknown Products: Simple Download Monitor Problem Types: CWE-22 Description: The Simple Download Monitor WordPress plugin before 3.9.5 allows users with a role as low as Contributor to download any file on the web server (such as wp-config.php) via a path traversal vector. Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/4c9fe97e-3d9b-4079-88d9-34e2d0605215
CVE ID: CVE-2021-24693 State: PUBLISHED Published: 2021-11-08T17:35:01 Last Updated: 2024-08-03T19:42:16.204Z Vendors: Unknown Products: Simple Download Monitor Problem Types: CWE-79 Description: The Simple Download Monitor WordPress plugin before 3.9.5 does not escape the "File Thumbnail" post meta before outputting it in some pages, which could allow users with a role as low as Contributor to perform Stored Cross-Site Scripting attacks. Given the that XSS is triggered even when the Download is in a review state, contributor could make JavaScript code execute in a context of a reviewer such as admin and make them create a rogue admin account, or install a malicious plugin Additional Analyst
of a reviewer such as admin and make them create a rogue admin account, or install a malicious plugin Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/4bb559b7-8dde-4c90-a9a6-d8dcfbea53a7
CVE ID: CVE-2021-24694 State: PUBLISHED Published: 2022-01-24T08:00:46 Last Updated: 2024-08-03T19:42:16.203Z Vendors: Unknown Products: Simple Download Monitor Problem Types: CWE-79 Description: The Simple Download Monitor WordPress plugin before 3.9.11 could allow users with a role as low as Contributor to perform Stored Cross-Site Scripting attack via 1) "color" or "css_class" argument of sdm_download shortcode, 2) "class" or "placeholder" argument of sdm_search_form shortcode. Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/9d0d8f8c-f8fb-457f-b557-255a052ccc32
CVE ID: CVE-2021-24695 State: PUBLISHED Published: 2021-11-08T17:35:02 Last Updated: 2024-08-03T19:42:16.114Z Vendors: Unknown Products: Simple Download Monitor Problem Types: CWE-425 Description: The Simple Download Monitor WordPress plugin before 3.9.6 saves logs in a predictable location, and does not have any authentication or authorisation in place to prevent unauthenticated users to download and read the logs containing Sensitive Information such as IP Addresses and Usernames Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/d7bdaf2b-cdd9-4aee-b1bb-01728160ff25
CVE ID: CVE-2021-24696 State: PUBLISHED Published: 2022-01-24T08:00:48 Last Updated: 2024-08-03T19:42:16.140Z Vendors: Unknown Products: Simple Download Monitor Problem Types: CWE-352 Description: The Simple Download Monitor WordPress plugin before 3.9.9 does not enforce nonce checks, which could allow attackers to perform CSRF attacks to 1) make admins export logs to exploit a separate log disclosure vulnerability (fixed in 3.9.6), 2) delete logs (fixed in 3.9.9), 3) remove thumbnail image from downloads Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/e94772af-39ac-4743-a556-52351ebda9fe
CVE ID: CVE-2021-24697 State: PUBLISHED Published: 2021-11-08T17:35:04 Last Updated: 2024-08-03T19:42:16.653Z Vendors: Unknown Products: Simple Download Monitor Problem Types: CWE-79 Description: The Simple Download Monitor WordPress plugin before 3.9.5 does not escape the 1) sdm_active_tab GET parameter and 2) sdm_stats_start_date/sdm_stats_end_date POST parameters before outputting them back in attributes, leading to Reflected Cross-Site Scripting issues Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/ef9ae513-6c29-45c2-b5ae-4a06a217c499
CVE ID: CVE-2021-24698 State: PUBLISHED Published: 2021-11-08T17:35:07 Last Updated: 2024-08-03T19:42:16.185Z Vendors: Unknown Products: Simple Download Monitor Problem Types: CWE-284 Description: The Simple Download Monitor WordPress plugin before 3.9.6 allows users with a role as low as Contributor to remove thumbnails from downloads they do not own, even if they cannot normally edit the download. Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/1fda1356-77d8-4e77-9ee6-8f9ceeb3d380
CVE ID: CVE-2021-24699 State: PUBLISHED Published: 2021-10-25T13:20:50 Last Updated: 2024-08-03T19:42:16.085Z Vendors: Unknown Products: Easy Media Download Problem Types: CWE-79 Description: The Easy Media Download WordPress plugin before 1.1.7 does not escape the text argument of its shortcode, which could allow users with a role as low as Contributor to perform Stored Cross-Site Scripting attacks. Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/4f5c3f75-0501-4a1a-95ea-cbfd3fc96852
CVE ID: CVE-2021-24700 State: PUBLISHED Published: 2021-11-23T19:16:06 Last Updated: 2024-08-03T19:42:16.968Z Vendors: Unknown Products: Forminator – Contact Form, Payment Form & Custom Form Builder Problem Types: CWE-79 Description: The Forminator WordPress plugin before 1.15.4 does not sanitize and escape the email field label, which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html is disallowed Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/1d489b05-296e-4268-8082-9737608f9b41
CVE ID: CVE-2021-24701 State: PUBLISHED Published: 2021-11-08T17:35:09 Last Updated: 2024-08-03T19:42:16.217Z Vendors: Unknown Products: Quiz Tool Lite Problem Types: CWE-79 Description: The Quiz Tool Lite WordPress plugin through 2.3.15 does not sanitize multiple input fields used when creating or managing quizzes and in other setting options, allowing high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed. Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/f7b95789-43f2-42a5-95e6-eb7accbd5ed3
CVE ID: CVE-2021-24702 State: PUBLISHED Published: 2021-10-18T13:46:00 Last Updated: 2024-08-03T19:42:16.630Z Vendors: Unknown Products: LearnPress – WordPress LMS Plugin Problem Types: CWE-79 Description: The LearnPress WordPress plugin before 4.1.3.1 does not properly sanitize or escape various inputs within course settings, which could allow high privilege users to perform Cross-Site Scripting attacks when the unfiltred_html capability is disallowed Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/30635cc9-4415-48bb-9c67-ea670ea1b942
CVE ID: CVE-2021-24703 State: PUBLISHED Published: 2021-11-23T19:16:07 Last Updated: 2024-08-03T19:42:16.132Z Vendors: Unknown Products: Download Plugin Problem Types: CWE-732 Description: The Download Plugin WordPress plugin before 1.6.1 does not have capability and CSRF checks in the dpwap_plugin_activate AJAX action, allowing any authenticated users, such as subscribers, to activate plugins that are already installed. Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/4ed8296e-1306-481f-9a22-723b051122c0
CVE ID: CVE-2021-24704 State: PUBLISHED Published: 2022-02-28T09:06:06 Last Updated: 2024-08-03T19:42:16.206Z Vendors: Unknown Products: Orange Form Problem Types: CWE-89, CWE-352 Description: In the Orange Form WordPress plugin through 1.0, the process_bulk_action() function in "admin/orange-form-email.php" performs an unprepared SQL query with an unsanitized parameter ($id). Only admin can access the page that invokes the function, but because of lack of CSRF protection, it is actually exploitable and could allow attackers to make a logged in admin delete arbitrary posts for example Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/60843022-f
for example Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/60843022-fe43-4608-8859-9c9109b35b42
CVE ID: CVE-2021-24705 State: PUBLISHED Published: 2021-12-13T10:40:44 Last Updated: 2024-08-03T19:42:16.117Z Vendors: Unknown Products: NEX-Forms Problem Types: CWE-79 Cross-Site Scripting (XSS), CWE-352 Cross-Site Request Forgery (CSRF) Description: The NEX-Forms WordPress plugin before 8.4.3 does not have CSRF checks in place when editing a form, and does not escape some of its settings as well as form fields before outputting them in attributes. This could allow attackers to make a logged in admin edit arbitrary forms with Cross-Site Scripting payloads in them Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/eca883d8-9499-4dbd-8fe1-4447fc2
l Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/eca883d8-9499-4dbd-8fe1-4447fc2ca28a
CVE ID: CVE-2021-24706 State: PUBLISHED Published: 2021-11-08T17:35:10 Last Updated: 2024-08-03T19:42:16.193Z Vendors: Unknown Products: Qwizcards – online quizzes and flashcards Problem Types: CWE-79 Description: The Qwizcards – online quizzes and flashcards WordPress plugin before 3.62 does not properly sanitize and escape some of its settings, allowing high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed. Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/ecddb611-de75-41d5-a470-8fc2cf0780a4
CVE ID: CVE-2021-24707 State: PUBLISHED Published: 2022-02-01T12:21:20 Last Updated: 2024-08-03T19:42:16.141Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Learning Courses WordPress plugin before 5.0 does not sanitise and escape the Email PDT identity token settings, which could allow high privilege users to perform cross-Site Scripting attacks even when the unfiltered_html capability is disallowed Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/0be5e06e-4ff1-43d2-8ba7-2530519d517e
CVE ID: CVE-2021-24708 State: PUBLISHED Published: 2021-11-08T17:35:12 Last Updated: 2024-08-03T19:42:16.872Z Vendors: Unknown Products: Export any WordPress data to XML/CSV Problem Types: CWE-79 Description: The Export any WordPress data to XML/CSV WordPress plugin before 1.3.1 does not escape its Export's Name before outputting it in Manage Exports settings, which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/4560eef4-253b-49a4-8e20-9520c45c6f7f
CVE ID: CVE-2021-24709 State: PUBLISHED Published: 2021-10-11T10:45:44 Last Updated: 2024-08-03T19:42:16.196Z Vendors: Unknown Products: Weather Effect – Christmas Santa Snow Falling Problem Types: CWE-79 Description: The Weather Effect WordPress plugin before 1.3.6 does not properly validate and escape some of its settings (like *_size_leaf, *_flakes_leaf, *_speed) which could lead to Stored Cross-Site Scripting issues Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/df74ed76-af9e-47a8-9a4d-c5c57e9e0f91
CVE ID: CVE-2021-24710 State: PUBLISHED Published: 2021-11-08T17:35:13 Last Updated: 2024-08-03T19:42:16.503Z Vendors: Unknown Products: Print-O-Matic Problem Types: CWE-79 Description: The Print-O-Matic WordPress plugin before 2.0.3 does not escape some of its settings before outputting them in attribute, which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed. Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/84e83d52-f69a-4de2-80c8-7c1996b30a04 - https://plugins.trac.wordpress.org/changeset/2610060/
CVE ID: CVE-2021-24711 State: PUBLISHED Published: 2021-10-11T10:45:45 Last Updated: 2024-08-03T19:42:16.146Z Vendors: Unknown Products: Software License Manager Problem Types: CWE-352 Description: The del_reistered_domains AJAX action of the Software License Manager WordPress plugin before 4.5.1 does not have any CSRF checks, and is vulnerable to a CSRF attack Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/3351bc30-e5ff-471f-8d1c-b1bcdf419937 - https://jetpack.com/2021/09/14/csrf-vulnerability-found-in-software-license-manager-plugin/
CVE ID: CVE-2021-24712 State: PUBLISHED Published: 2021-10-11T10:45:47 Last Updated: 2024-08-03T19:42:16.117Z Vendors: Unknown Products: Appointment Hour Booking – WordPress Booking Plugin Problem Types: CWE-79 Description: The Appointment Hour Booking WordPress plugin before 1.3.17 does not properly sanitize values used when creating new calendars. Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/e677e51b-0d3f-44a5-9fcd-c159786b9926
CVE ID: CVE-2021-24713 State: PUBLISHED Published: 2021-11-23T19:16:09 Last Updated: 2024-08-03T19:42:16.189Z Vendors: TODO Products: Video Lessons Manager – Best Video Course LMS, Video Lessons Manager Pro – Best Video Course LMS Problem Types: CWE-79 Description: The Video Lessons Manager WordPress plugin before 1.7.2 and Video Lessons Manager Pro WordPress plugin before 3.5.9 do not properly sanitize and escape values when updating their settings, which could allow high privilege users to perform Cross-Site Scripting attacks Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/4a90be69-41eb-43e9-962d-34316497b4df
CVE ID: CVE-2021-24714 State: PUBLISHED Published: 2021-12-06T15:55:23 Last Updated: 2024-08-03T19:42:16.660Z Vendors: Unknown Products: Import any XML or CSV File to WordPress Problem Types: CWE-79 Description: The Import any XML or CSV File to WordPress plugin before 3.6.3 does not escape the Import's Title and Unique Identifier fields before outputting them in admin pages, which could allow high privilege users to perform Cross-Site attacks even when the unfiltered_html capability is disallowed. Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/a8d314b9-26ac-4b56-a85c-a2528e55e73a
CVE ID: CVE-2021-24715 State: PUBLISHED Published: 2021-11-01T08:46:07 Last Updated: 2024-08-03T19:42:16.609Z Vendors: Unknown Products: WP Sitemap Page Problem Types: CWE-79 Description: The WP Sitemap Page WordPress plugin before 1.7.0 does not properly sanitise and escape some of its settings, which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed. Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/da66d54e-dda8-4aa8-8d27-b8b87100bb21
CVE ID: CVE-2021-24716 State: PUBLISHED Published: 2021-11-01T08:46:09 Last Updated: 2024-08-03T19:42:16.663Z Vendors: Unknown Products: Modern Events Calendar Lite Problem Types: CWE-79 Description: The Modern Events Calendar Lite WordPress plugin before 5.22.3 does not properly sanitize or escape values set by users with access to adjust settings withing wp-admin. Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/576cc93d-1499-452b-97dd-80f69002e2a0
CVE ID: CVE-2021-24717 State: PUBLISHED Published: 2021-11-01T08:46:11 Last Updated: 2024-08-03T19:42:16.585Z Vendors: Unknown Products: AutomatorWP Problem Types: CWE-863 Description: The AutomatorWP WordPress plugin before 1.7.6 does not perform capability checks which allows users with Subscriber roles to enumerate automations, disclose title of private posts or user emails, call functions, or perform privilege escalation via Ajax actions. Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/5916ea42-eb33-463d-8528-2a142805c91f
CVE ID: CVE-2021-24718 State: PUBLISHED Published: 2021-12-06T15:55:24 Last Updated: 2024-08-03T19:42:16.633Z Vendors: Unknown Products: Contact Form, Survey & Popup Form Plugin for WordPress – ARForms Form Builder Problem Types: CWE-79 Description: The Contact Form, Survey & Popup Form Plugin for WordPress plugin before 1.5 does not properly sanitize some of its settings allowing high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/60c9d78f-ae2c-49e0-aca3-6dce1bd8f697
CVE ID: CVE-2021-24719 State: PUBLISHED Published: 2021-10-11T10:45:48 Last Updated: 2024-08-03T19:42:16.657Z Vendors: Unknown Products: Enfold Problem Types: CWE-79 Description: The Enfold Enfold WordPress theme before 4.8.4 was vulnerable to Reflected Cross-Site Scripting (XSS). The vulnerability is present on Enfold versions previous than 4.8.4 which use Avia Page Builder. Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/a53e213f-6011-47f8-93e6-aa5ad30e857e - http://packetstormsecurity.com/files/164548/WordPress-Enfold-Theme-4.8.3-Cross-Site-Scripting.html
CVE ID: CVE-2021-24720 State: PUBLISHED Published: 2021-10-11T10:45:50 Last Updated: 2024-08-03T19:42:16.664Z Vendors: Unknown Products: Business Directory Plugin | GeoDirectory Problem Types: CWE-79 Description: The GeoDirectory Business Directory WordPress plugin before 2.1.1.3 was vulnerable to Authenticated Stored Cross-Site Scripting (XSS). Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/9de5cc51-f64c-4475-a0f4-d932dc4364a6 - https://github.com/BigTiger2020/word-press/blob/main/WrodPress%20Plugin%20GeoDirectory%E2%80%94%E2%80%94Stored%20Cross-Site%20Scripting%20.md - https://plugins.trac.wordpress.org/changeset/2596452/geodirectory
CVE ID: CVE-2021-24721 State: PUBLISHED Published: 2021-11-08T17:35:14 Last Updated: 2024-08-03T19:42:16.687Z Vendors: Unknown Products: Loco Translate Problem Types: CWE-94 Description: The Loco Translate WordPress plugin before 2.5.4 mishandles data inputs which get saved to a file, which can be renamed to an extension ending in .php, resulting in authenticated "translator" users being able to inject PHP code into files ending with .php in web accessible locations. Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/bc7d4774-fce8-4b0b-8015-8ef4c5b02d38
CVE ID: CVE-2021-24722 State: PUBLISHED Published: 2021-11-01T08:46:12 Last Updated: 2024-08-03T19:42:16.659Z Vendors: Unknown Products: Restaurant Menu by MotoPress Problem Types: CWE-79 Description: The Restaurant Menu by MotoPress WordPress plugin before 2.4.2 does not properly sanitize or escape inputs when creating new menu items, which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/14b29450-2450-4b5f-8630-bb2cbfbd0a83
CVE ID: CVE-2021-24723 State: PUBLISHED Published: 2021-11-01T08:46:14 Last Updated: 2024-08-03T19:42:16.809Z Vendors: Unknown Products: WP Reactions Lite Problem Types: CWE-79 Description: The WP Reactions Lite WordPress plugin before 1.3.6 does not properly sanitize inputs within wp-admin pages, allowing users with sufficient access to inject XSS payloads within /wp-admin/ pages. Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/0a46ae96-41e5-4b52-91c3-409f7387aecc
CVE ID: CVE-2021-24724 State: PUBLISHED Published: 2021-09-13T17:56:38 Last Updated: 2024-08-03T19:42:16.651Z Vendors: Unknown Products: Timetable and Event Schedule by MotoPress Problem Types: CWE-79 Description: The Timetable and Event Schedule by MotoPress WordPress plugin before 2.3.19 does not sanitise some of its parameters, which could allow low privilege users such as author to perform XSS attacks against frontend and backend users when viewing the related event/s Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/c1194a1e-bf33-4f3f-a4a6-27b76b1b1eeb - https://plugins.trac.wordpress.org/changeset/2573479/ - https://www.trustwave.com/en-u
a1e-bf33-4f3f-a4a6-27b76b1b1eeb - https://plugins.trac.wordpress.org/changeset/2573479/ - https://www.trustwave.com/en-us/resources/security-resources/security-advisories/?fid=29235
CVE ID: CVE-2021-24725 State: PUBLISHED Published: 2021-09-13T17:56:39 Last Updated: 2024-08-03T19:42:16.624Z Vendors: Unknown Products: Comment Link Remove and Other Comment Tools Problem Types: CWE-352 Description: The Comment Link Remove and Other Comment Tools WordPress plugin before 2.1.6 does not have CSRF check in its 'Delete comments easily', which could allow attackers to make logged in admin delete arbitrary comments Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/01483284-57f5-4ae9-b5f1-ae26b623571f - https://www.trustwave.com/en-us/resources/security-resources/security-advisories/?fid=29225
CVE ID: CVE-2021-24726 State: PUBLISHED Published: 2021-09-13T17:56:41 Last Updated: 2024-08-03T19:42:16.643Z Vendors: Unknown Products: WP Simple Booking Calendar Problem Types: CWE-89 Description: The WP Simple Booking Calendar WordPress plugin before 2.0.6 did not escape, validate or sanitise the orderby parameter in its Search Calendars action, before using it in a SQL statement, leading to an authenticated SQL injection issue Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/f85b6033-d7c1-45b7-b3b0-8967f7373bb8 - https://www.trustwave.com/en-us/resources/security-resources/security-advisories/?fid=29176
CVE ID: CVE-2021-24727 State: PUBLISHED Published: 2021-09-13T17:56:42 Last Updated: 2024-08-03T19:42:16.852Z Vendors: Unknown Products: WP Block and Stop Bad Bots Crawlers and Spiders and Anti Spam Protection Plugin StopBadBots Problem Types: CWE-89 Description: The StopBadBots WordPress plugin before 6.60 did not validate or escape the order and orderby GET parameter in some of its admin dashboard pages, leading to Authenticated SQL Injections Additional Analyst Notes: - CVE Program Container: References: - https://www.trustwave.com/en-us/resources/security-resources/security-advisories/?fid=29174 - https://wpscan.com/vulnerability/ffa1f718-f2c5-48ef-8eea-33a18a628a2c - https://plugins.tra
rity-advisories/?fid=29174 - https://wpscan.com/vulnerability/ffa1f718-f2c5-48ef-8eea-33a18a628a2c - https://plugins.trac.wordpress.org/changeset/2576276/