Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2021-24327 State: PUBLISHED Published: 2021-05-17T16:48:54 Last Updated: 2024-08-03T19:28:24.001Z Vendors: Unknown Products: SEO Redirection Plugin – 301 Redirect Manager Problem Types: CWE-79 Description: The SEO Redirection Plugin – 301 Redirect Manager WordPress plugin before 6.4 did not sanitise the Redirect From and Redirect To fields when creating a new redirect in the dashboard, allowing high privilege users (even with the unfiltered_html disabled) to set XSS payloads Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/ca8068f7-dcf0-44fd-841d-d02987220d79
CVE ID: CVE-2021-24328 State: PUBLISHED Published: 2021-06-01T11:33:31 Last Updated: 2024-08-03T19:28:23.829Z Vendors: Unknown Products: WP Login Security and History Problem Types: CWE-352 Description: The WP Login Security and History WordPress plugin through 1.0 did not have CSRF check when saving its settings, not any sanitisation or validation on them. This could allow attackers to make logged in administrators change the plugin's settings to arbitrary values, and set XSS payloads on them as well Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/eeb41d7b-8f9e-4a12-b65f-f310f08e4ace - https://m0ze.ru/exploit/csrf-wp-login-security-and-histo
wpscan.com/vulnerability/eeb41d7b-8f9e-4a12-b65f-f310f08e4ace - https://m0ze.ru/exploit/csrf-wp-login-security-and-history-v1.0.html - https://m0ze.ru/vulnerability/%5B2021-03-29%5D-%5BWordPress%5D-%5BCWE-352%5D-WP-Login-Security-and-History-WordPress-Plugin-v1.0.txt - https://m0ze.ru/vulnerability/%5B2021-03-29%5D-%5BWordPress%5D-%5BCWE-79%5D-WP-Login-Security-and-History-WordPress-Plugin-v1.0.txt
CVE ID: CVE-2021-24329 State: PUBLISHED Published: 2021-06-01T11:33:31 Last Updated: 2024-08-03T19:28:23.520Z Vendors: Unknown Products: WP Super Cache Problem Types: CWE-79 Description: The WP Super Cache WordPress plugin before 1.7.3 did not properly sanitise its wp_cache_location parameter in its settings, which could lead to a Stored Cross-Site Scripting issue. Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/9df86d05-1408-4c22-af55-5e3d44249fd0 - https://m0ze.ru/vulnerability/%5B2021-03-23%5D-%5BWordPress%5D-%5BCWE-79%5D-WP-Super-Cache-WordPress-Plugin-v1.7.2.txt
CVE ID: CVE-2021-24330 State: PUBLISHED Published: 2021-06-01T11:33:31 Last Updated: 2024-08-03T19:28:23.352Z Vendors: Unknown Products: Funnel Builder by CartFlows – Create High Converting Sales Funnels For WordPress Problem Types: CWE-79 Description: The Funnel Builder by CartFlows – Create High Converting Sales Funnels For WordPress plugin before 1.6.13 did not sanitise its facebook_pixel_id and google_analytics_id settings, allowing high privilege users to set XSS payload in them, which will either be executed on pages generated by the plugin, or the whole website depending on the settings used. Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerabi
ding on the settings used. Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/b9748066-83b7-4762-9124-de021f687477 - https://m0ze.ru/vulnerability/%5B2021-04-26%5D-%5BWordPress%5D-%5BCWE-79%5D-Funnel-Builder-by-CartFlows-WordPress-Plugin-v1.6.12.txt
CVE ID: CVE-2021-24331 State: PUBLISHED Published: 2021-06-01T11:33:31 Last Updated: 2024-08-03T19:28:23.411Z Vendors: Unknown Products: Smooth Scroll Page Up/Down Buttons Problem Types: CWE-79 Description: The Smooth Scroll Page Up/Down Buttons WordPress plugin before 1.4 did not properly sanitise and validate its settings, such as psb_distance, psb_buttonsize, psb_speed, only validating them client side. This could allow high privilege users (such as admin) to set XSS payloads in them Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/2c7ca586-def8-4723-b779-09d7f37fa1ab - https://m0ze.ru/vulnerability/%5B2021-04-24%5D-%5BWordPress%5D-%5BCWE-7
erability/2c7ca586-def8-4723-b779-09d7f37fa1ab - https://m0ze.ru/vulnerability/%5B2021-04-24%5D-%5BWordPress%5D-%5BCWE-79%5D-Smooth-Scroll-Page-UpDown-Buttons-WordPress-Plugin-v1.3.txt
CVE ID: CVE-2021-24332 State: PUBLISHED Published: 2021-05-24T10:58:05 Last Updated: 2024-08-03T19:28:23.474Z Vendors: Unknown Products: Autoptimize Problem Types: CWE-79 Description: The Autoptimize WordPress plugin before 2.8.4 was missing proper escaping and sanitisation in some of its settings, allowing high privilege users to set XSS payloads in them, leading to stored Cross-Site Scripting issues Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/6678e064-ce21-4bb2-8c50-061073fb22fb - https://m0ze.ru/vulnerability/%5B2021-04-01%5D-%5BWordPress%5D-%5BCWE-79%5D-Autoptimize-WordPress-Plugin-v2.8.3.txt
CVE ID: CVE-2021-24333 State: PUBLISHED Published: 2021-06-01T11:33:31 Last Updated: 2024-08-03T19:28:23.400Z Vendors: Unknown Products: Content Copy Protection & Prevent Image Save Problem Types: CWE-352 Description: The Content Copy Protection & Prevent Image Save WordPress plugin through 1.3 does not check for CSRF when saving its settings, not perform any validation and sanitisation on them, allowing attackers to make a logged in administrator set arbitrary XSS payloads in them. Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/c722f8d0-f86b-41c2-9f1f-48e475e22864 - https://m0ze.ru/exploit/csrf-prevent-content-copy-image-save-v1.3.html - ht
ility/c722f8d0-f86b-41c2-9f1f-48e475e22864 - https://m0ze.ru/exploit/csrf-prevent-content-copy-image-save-v1.3.html - https://m0ze.ru/vulnerability/%5B2021-03-29%5D-%5BWordPress%5D-%5BCWE-352%5D-Content-Copy-Protection-Prevent-Image-Save-WordPress-Plugin-v1.3.txt - https://m0ze.ru/vulnerability/%5B2021-03-29%5D-%5BWordPress%5D-%5BCWE-79%5D-Content-Copy-Protection-Prevent-Image-Save-WordPress-Plugin-v1.3.txt
CVE ID: CVE-2021-24334 State: PUBLISHED Published: 2021-06-01T11:33:31 Last Updated: 2024-08-03T19:28:23.432Z Vendors: Unknown Products: Instant Images – One Click Unsplash Uploads Problem Types: CWE-79 Description: The Instant Images – One Click Unsplash Uploads WordPress plugin before 4.4.0.1 did not properly validate and sanitise its unsplash_download_w and unsplash_download_h parameter settings (/wp-admin/upload.php?page=instant-images), only validating them client side before saving them, leading to a Stored Cross-Site Scripting issue. Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/ae79189a-6b63-4110-9567-cd7c97d71e4f - https://m0ze.ru/
rogram Container: References: - https://wpscan.com/vulnerability/ae79189a-6b63-4110-9567-cd7c97d71e4f - https://m0ze.ru/vulnerability/%5B2021-04-22%5D-%5BWordPress%5D-%5BCWE-79%5D-Instant-Images-WordPress-Plugin-v4.4.0.txt
CVE ID: CVE-2021-24335 State: PUBLISHED Published: 2021-06-01T11:33:31 Last Updated: 2024-08-03T19:28:23.425Z Vendors: Unknown Products: Car Repair Services & Auto Mechanic Problem Types: CWE-79 Description: The Car Repair Services & Auto Mechanic WordPress theme before 4.0 did not properly sanitise its serviceestimatekey search parameter before outputting it back in the page, leading to a reflected Cross-Site Scripting issue Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/39258aba-2449-4214-a490-b8e46945117d - https://themeforest.net/item/car-repair-services-auto-mechanic-wordpress-theme/19823557 - https://m0ze.ru/vulnerability/%5B2021-02-12
forest.net/item/car-repair-services-auto-mechanic-wordpress-theme/19823557 - https://m0ze.ru/vulnerability/%5B2021-02-12%5D-%5BWordPress%5D-%5BCWE-79%5D-Car-Repair-Services-WordPress-Theme-v3.9.txt
CVE ID: CVE-2021-24336 State: PUBLISHED Published: 2021-06-07T10:49:49 Last Updated: 2024-08-03T19:28:23.422Z Vendors: Unknown Products: FlightLog Problem Types: CWE-89 Description: The FlightLog WordPress plugin through 3.0.2 does not sanitise, validate or escape various POST parameters before using them a SQL statement, leading to SQL injections exploitable by editor and administrator users Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/dda0593e-cd97-454e-a8c8-15d7f690311c - https://codevigilant.com/disclosure/2021/wp-plugin-flightlog-sql-injection/
CVE ID: CVE-2021-24337 State: PUBLISHED Published: 2021-06-07T10:49:50 Last Updated: 2024-08-03T19:28:23.427Z Vendors: Unknown Products: Video Embed Problem Types: CWE-89 Description: The id GET parameter of one of the Video Embed WordPress plugin through 1.0's page (available via forced browsing) is not sanitised, validated or escaped before being used in a SQL statement, allowing low privilege users, such as subscribers, to perform SQL injection. Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/a8fd8dd4-5b5e-462e-8dae-065d5e2d003a - https://codevigilant.com/disclosure/2021/wp-plugin-video-embed-box/
CVE ID: CVE-2021-24338 State: PUBLISHED Published: 2021-06-21T19:18:12 Last Updated: 2024-08-03T19:28:23.481Z Vendors: Pods Framework Team Products: Pods – Custom Content Types and Fields Problem Types: CWE-79 Description: The Pods – Custom Content Types and Fields WordPress plugin before 2.7.27 was vulnerable to an Authenticated Stored Cross-Site Scripting (XSS) security vulnerability within the 'Singular Label' field parameter. Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/d5b015f3-90c7-4d51-a71d-630d60965151 - https://www.whitesourcesoftware.com/vulnerability-database/CVE-2021-24338
CVE ID: CVE-2021-24339 State: PUBLISHED Published: 2021-06-21T19:18:13 Last Updated: 2024-08-03T19:28:23.582Z Vendors: Pods Framework Team Products: Pods – Custom Content Types and Fields Problem Types: CWE-79 Description: The Pods – Custom Content Types and Fields WordPress plugin before 2.7.27 was vulnerable to an Authenticated Stored Cross-Site Scripting (XSS) security vulnerability within the 'Menu Label' field parameter. Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/8e72236d-f620-4503-a324-dcf49405351b - https://www.whitesourcesoftware.com/vulnerability-database/CVE-2021-24339
CVE ID: CVE-2021-24340 State: PUBLISHED Published: 2021-06-07T10:49:50 Last Updated: 2024-08-03T19:28:23.425Z Vendors: VeronaLabs Products: WP Statistics Problem Types: CWE-89 Description: The WP Statistics WordPress plugin before 13.0.8 relied on using the WordPress esc_sql() function on a field not delimited by quotes and did not first prepare the query. Additionally, the page, which should have been accessible to administrator only, was also available to any visitor, including unauthenticated ones. Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/d2970cfb-0aa9-4516-9a4b-32971f41a19c - https://www.wordfence.com/blog/2021/05/over-600000-sites
wpscan.com/vulnerability/d2970cfb-0aa9-4516-9a4b-32971f41a19c - https://www.wordfence.com/blog/2021/05/over-600000-sites-impacted-by-wp-statistics-patch/
CVE ID: CVE-2021-24341 State: PUBLISHED Published: 2021-06-14T13:37:12 Last Updated: 2024-08-03T19:28:23.417Z Vendors: Unknown Products: Xllentech English Islamic Calendar Problem Types: CWE-89 Description: When deleting a date in the Xllentech English Islamic Calendar WordPress plugin before 2.6.8, the year_number and month_number POST parameters are not sanitised, escaped or validated before being used in a SQL statement, leading to SQL injection. Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/1eba1c73-a19b-4226-afec-d27c48388a04 - https://codevigilant.com/disclosure/2021/xllentech-english-islamic-calendar/
CVE ID: CVE-2021-24342 State: PUBLISHED Published: 2021-06-07T10:49:50 Last Updated: 2024-08-03T19:28:23.516Z Vendors: Unknown Products: JNews Problem Types: CWE-79 Description: The JNews WordPress theme before 8.0.6 did not sanitise the cat_id parameter in the POST request /?ajax-request=jnews (with action=jnews_build_mega_category_*), leading to a Reflected Cross-Site Scripting (XSS) issue. Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/415ca763-fe65-48cb-acd3-b375a400217e
CVE ID: CVE-2021-24343 State: PUBLISHED Published: 2021-06-07T10:49:50 Last Updated: 2024-08-03T19:28:23.568Z Vendors: Unknown Products: iFlyChat – WordPress Chat Problem Types: CWE-79 Description: The iFlyChat WordPress plugin before 4.7.0 does not sanitise its APP ID setting before outputting it back in the page, leading to an authenticated Stored Cross-Site Scripting issue Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/d6c72d90-e321-47b9-957a-6fea7c944293
CVE ID: CVE-2021-24344 State: PUBLISHED Published: 2021-06-07T10:49:50 Last Updated: 2024-08-03T19:28:23.440Z Vendors: Unknown Products: Easy Preloader Problem Types: CWE-79 Description: The Easy Preloader WordPress plugin through 1.0.0 does not sanitise its setting fields, leading to authenticated (admin+) Stored Cross-Site scripting issues Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/6d6c1d46-5c3d-4d56-9728-2f94064132aa
CVE ID: CVE-2021-24345 State: PUBLISHED Published: 2021-06-14T13:37:12 Last Updated: 2024-08-03T19:28:23.560Z Vendors: Unknown Products: Sendit WP Newsletter Problem Types: CWE-89 Description: The page lists-management feature of the Sendit WP Newsletter WordPress plugin through 2.5.1, available to Administrator users does not sanitise, validate or escape the id_lista POST parameter before using it in SQL statement, therefore leading to Blind SQL Injection. Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/02ba4d8b-f4d2-42cd-9fae-b543e112fa04 - https://codevigilant.com/disclosure/2021/wp-plugin-sendit/
CVE ID: CVE-2021-24346 State: PUBLISHED Published: 2021-06-14T13:37:12 Last Updated: 2024-08-03T19:28:23.463Z Vendors: Unknown Products: Stock in & out Problem Types: CWE-79 Description: The Stock in & out WordPress plugin through 1.0.4 has a search functionality, the lowest accessible level to it being contributor. The srch POST parameter is not validated, sanitised or escaped before using it in the echo statement, leading to a reflected XSS issue Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/c25146fd-4143-463c-8c85-05dd33e9a77b - https://codevigilant.com/disclosure/2021/wp-plugin-stock-in/
CVE ID: CVE-2021-24347 State: PUBLISHED Published: 2021-06-14T13:37:12 Last Updated: 2024-08-03T19:28:23.833Z Vendors: Unknown Products: SP Project & Document Manager Problem Types: CWE-178 Description: The SP Project & Document Manager WordPress plugin before 4.22 allows users to upload files, however, the plugin attempts to prevent php and other similar files that could be executed on the server from being uploaded by checking the file extension. It was discovered that php files could still be uploaded by changing the file extension's case, for example, from "php" to "pHP". Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/8f6e82d5-c0e9-468e-
". Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/8f6e82d5-c0e9-468e-acb8-7cd549f6a45a - http://packetstormsecurity.com/files/163434/WordPress-SP-Project-And-Document-Manager-4.21-Shell-Upload.html - http://packetstormsecurity.com/files/163675/WordPress-SP-Project-And-Document-Remote-Code-Execution.html
CVE ID: CVE-2021-24348 State: PUBLISHED Published: 2021-06-14T13:37:12 Last Updated: 2024-08-03T19:28:23.690Z Vendors: Unknown Products: Side Menu – add fixed side buttons Problem Types: CWE-89 Description: The menu delete functionality of the Side Menu – add fixed side buttons WordPress plugin before 3.1.5, available to Administrator users takes the did GET parameter and uses it into an SQL statement without proper sanitisation, validation or escaping, therefore leading to a SQL Injection issue Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/e0ca257e-6e78-4611-a9ad-be43d37cf474 - https://codevigilant.com/disclosure/2021/wp-plugin-side-menu/
CVE ID: CVE-2021-24349 State: PUBLISHED Published: 2021-06-14T13:37:13 Last Updated: 2024-08-03T19:28:23.787Z Vendors: Unknown Products: Gallery from files Problem Types: CWE-79, CWE-352 Description: This Gallery from files WordPress plugin through 1.6.0 gives the functionality of uploading images to the server. But filenames are not properly sanitized before being output in an error message when they have an invalid extension, leading to a reflected Cross-Site Scripting issue. Due to the lack of CSRF check, the attack could also be performed via such vector. Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/6bb4eb71-d702-4732-b01f-b723077d66ca
CVE ID: CVE-2021-24350 State: PUBLISHED Published: 2021-06-14T13:37:13 Last Updated: 2024-08-03T19:28:23.777Z Vendors: Unknown Products: Visitors Problem Types: CWE-79 Description: The Visitors WordPress plugin through 0.3 is affected by an Unauthenticated Stored Cross-Site Scripting (XSS) vulnerability. The plugin would display the user's user agent string without validation or encoding within the WordPress admin panel. Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/06f1889d-8e2f-481a-b91b-3a8008e00ffc
CVE ID: CVE-2021-24351 State: PUBLISHED Published: 2021-06-14T13:37:13 Last Updated: 2024-08-03T19:28:23.522Z Vendors: Unknown Products: The Plus Addons for Elementor Page Builder Problem Types: CWE-79 Description: The theplus_more_post AJAX action of The Plus Addons for Elementor Page Builder WordPress plugin before 4.1.12 did not properly sanitise some of its fields, leading to a reflected Cross-Site Scripting (exploitable on both unauthenticated and authenticated users) Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/2ee62f85-7aea-4b7d-8b2d-5d86d9fb8016 - https://theplusaddons.com/changelog/
CVE ID: CVE-2021-24352 State: PUBLISHED Published: 2021-06-14T13:37:13 Last Updated: 2024-08-03T19:28:23.446Z Vendors: Unknown Products: Simple 301 Redirects by BetterLinks Problem Types: CWE-862 Description: The export_data function of the Simple 301 Redirects by BetterLinks WordPress plugin before 2.0.4 had no capability or nonce checks making it possible for unauthenticated users to export a site's redirects. Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/d770f1fa-7652-465a-833c-b7178146847d - https://www.wordfence.com/blog/2021/05/severe-vulnerabilities-patched-in-simple-301-redirects-by-betterlinks-plugin/
CVE ID: CVE-2021-24353 State: PUBLISHED Published: 2021-06-14T13:37:13 Last Updated: 2024-08-03T19:28:23.449Z Vendors: Unknown Products: Simple 301 Redirects by BetterLinks Problem Types: CWE-862 Description: The import_data function of the Simple 301 Redirects by BetterLinks WordPress plugin before 2.0.4 had no capability or nonce checks making it possible for unauthenticated users to import a set of site redirects. Additional Analyst Notes: - CVE Program Container: References: - https://www.wordfence.com/blog/2021/05/severe-vulnerabilities-patched-in-simple-301-redirects-by-betterlinks-plugin/ - https://wpscan.com/vulnerability/74c23d56-e81f-47e9-bf8b-33d3f0e81894
CVE ID: CVE-2021-24354 State: PUBLISHED Published: 2021-06-14T13:37:13 Last Updated: 2024-08-03T19:28:23.447Z Vendors: Unknown Products: Simple 301 Redirects by BetterLinks Problem Types: CWE-862 Description: A lack of capability checks and insufficient nonce check on the AJAX action in the Simple 301 Redirects by BetterLinks WordPress plugin before 2.0.4, made it possible for authenticated users to install arbitrary plugins on vulnerable sites. Additional Analyst Notes: - CVE Program Container: References: - https://www.wordfence.com/blog/2021/05/severe-vulnerabilities-patched-in-simple-301-redirects-by-betterlinks-plugin/ - https://wpscan.com/vulnerability/8638b36c-6641-491f-b9df-5db3645e4
ched-in-simple-301-redirects-by-betterlinks-plugin/ - https://wpscan.com/vulnerability/8638b36c-6641-491f-b9df-5db3645e4668
CVE ID: CVE-2021-24355 State: PUBLISHED Published: 2021-06-14T13:37:13 Last Updated: 2024-08-03T19:28:23.655Z Vendors: Unknown Products: Simple 301 Redirects by BetterLinks Problem Types: CWE-862 Description: In the Simple 301 Redirects by BetterLinks WordPress plugin before 2.0.4, the lack of capability checks and insufficient nonce check on the AJAX actions, simple301redirects/admin/get_wildcard and simple301redirects/admin/wildcard, made it possible for authenticated users to retrieve and update the wildcard value for redirects. Additional Analyst Notes: - CVE Program Container: References: - https://www.wordfence.com/blog/2021/05/severe-vulnerabilities-patched-in-simple-301-redirects-by-
ntainer: References: - https://www.wordfence.com/blog/2021/05/severe-vulnerabilities-patched-in-simple-301-redirects-by-betterlinks-plugin/ - https://wpscan.com/vulnerability/ce8f9648-30fb-4fb9-894e-879dc0f26f98
CVE ID: CVE-2021-24356 State: PUBLISHED Published: 2021-06-14T13:37:13 Last Updated: 2024-08-03T19:28:23.784Z Vendors: Unknown Products: Simple 301 Redirects by BetterLinks Problem Types: CWE-862 Description: In the Simple 301 Redirects by BetterLinks WordPress plugin before 2.0.4, a lack of capability checks and insufficient nonce check on the AJAX action, simple301redirects/admin/activate_plugin, made it possible for authenticated users to activate arbitrary plugins installed on vulnerable sites. Additional Analyst Notes: - CVE Program Container: References: - https://www.wordfence.com/blog/2021/05/severe-vulnerabilities-patched-in-simple-301-redirects-by-betterlinks-plugin/ - https://wpsc
.wordfence.com/blog/2021/05/severe-vulnerabilities-patched-in-simple-301-redirects-by-betterlinks-plugin/ - https://wpscan.com/vulnerability/be356530-5e00-4f27-8177-b80f3c1ae6e8
CVE ID: CVE-2021-24357 State: PUBLISHED Published: 2021-06-14T13:37:14 Last Updated: 2024-08-03T19:28:23.478Z Vendors: FooPlugins Products: Best Image Gallery & Responsive Photo Gallery – FooGallery Problem Types: CWE-79 Description: In the Best Image Gallery & Responsive Photo Gallery – FooGallery WordPress plugin before 2.0.35, the Custom CSS field of each gallery is not properly sanitised or validated before being being output in the page where the gallery is embed, leading to a stored Cross-Site Scripting issue. Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/950f46ae-4476-4969-863a-0e55752953b3
CVE ID: CVE-2021-24358 State: PUBLISHED Published: 2021-06-14T13:37:14 Last Updated: 2024-08-03T19:28:23.441Z Vendors: Unknown Products: The Plus Addons for Elementor Page Builder Problem Types: CWE-601 Description: The Plus Addons for Elementor Page Builder WordPress plugin before 4.1.10 did not validate a redirect parameter on a specifically crafted URL before redirecting the user to it, leading to an Open Redirect issue. Additional Analyst Notes: - CVE Program Container: References: - https://theplusaddons.com/changelog/ - https://wpscan.com/vulnerability/fd4352ad-dae0-4404-94d1-11083cb1f44d
CVE ID: CVE-2021-24359 State: PUBLISHED Published: 2021-06-14T13:37:14 Last Updated: 2024-08-03T19:28:23.838Z Vendors: Unknown Products: The Plus Addons for Elementor Page Builder Problem Types: CWE-284 Description: The Plus Addons for Elementor Page Builder WordPress plugin before 4.1.11 did not properly check that a user requesting a password reset was the legitimate user, allowing an attacker to send an arbitrary reset password email to a registered user on behalf of the WordPress site. Such issue could be chained with an open redirect (CVE-2021-24358) in version below 4.1.10, to include a crafted password reset link in the email, which would lead to an account takeover. Additional Analys