rainbutterfly/cve_corpus huggingface dataset:
CVE-2021-24999 Booster for Woocommerce < 5.4.9 - Reflected Cross-Site Scripting in PDF Invoicing Module
The Booster for WooCommerce WordPress plugin before 5.4.9 does not sanitise and escape the wcj_notice parameter before outputting it back in the admin dashboard when the Pdf Invoicing module is enabled, leading to a Reflected Cross-Site Scripting
Problem types: cwe_id: CWE-79
description: CWE-79 Cross-site Scripting (XSS)
Affected products: vendor: Unknown
product: Booster for WooCommerce
Credits: lang: en
value: Jeremie Amsellem
Published: 2022-01-03T12:49:10.000Z
CVE-2021-25000 Booster for WooCommerce < 5.4.9 - Reflected Cross-Site Scripting in General Module
The Booster for WooCommerce WordPress plugin before 5.4.9 does not sanitise and escape the wcj_delete_role parameter before outputting back in the admin dashboard when the General module is enabled, leading to a Reflected Cross-Site Scripting issue
Problem types: cwe_id: CWE-79
description: CWE-79 Cross-site Scripting (XSS)
Affected products: vendor: Unknown
product: Booster for WooCommerce
Credits: lang: en
value: Jeremie Amsellem
Published: 2022-01-03T12:49:11.000Z
CVE-2021-25001 Booster for WooCommerce < 5.4.9 - Reflected Cross-Site Scripting in Product XML Feeds Module
The Booster for WooCommerce WordPress plugin before 5.4.9 does not sanitise and escape the wcj_create_products_xml_result parameter before outputting back in the admin dashboard when the Product XML Feeds module is enabled, leading to a Reflected Cross-Site Scripting issue
Problem types: cwe_id: CWE-79
description: CWE-79 Cross-site Scripting (XSS)
Affected products: vendor: Unknown
product: Booster for WooCommerce
Credits: lang: en
value: Jeremie Amsellem
Published: 2022-01-03T12:49:12.000Z
CVE-2021-25002 Tipsacarrier < 1.5.0.5 - Unauthenticated Orders Disclosure
The Tipsacarrier WordPress plugin before 1.5.0.5 does not have any authorisation check in place some functions, which could allow unauthenticated users to access Orders data which could be used to retrieve the client full address, name and phone via tracking URL
Problem types: cwe_id: CWE-862
description: CWE-862 Missing Authorization
Affected products: vendor: Unknown
product: Tipsacarrier
Credits: lang: en
value: José Aguilera
Published: 2022-05-02T16:05:29.000Z
CVE-2021-25003 WPCargo < 6.9.0 - Unauthenticated RCE
The WPCargo Track & Trace WordPress plugin before 6.9.0 contains a file which could allow unauthenticated attackers to write a PHP file anywhere on the web server, leading to RCE
Problem types: cwe_id: CWE-94
description: CWE-94 Improper Control of Generation of Code ('Code Injection')
Affected products: vendor: Unknown
product: WPCargo Track & Trace
Credits: lang: en
value: Krzysztof Zając
Published: 2022-03-14T14:41:11.000Z
CVE-2021-25004 SEUR Oficial < 1.7.2 - Admin+ Arbitrary File Download
The SEUR Oficial WordPress plugin before 1.7.2 creates a PHP file with a random name when installed, even though it is used for support purposes, it allows to download any file from the web server without restriction after knowing the URL and a password than an administrator can see in the plugin settings page.
Problem types: cwe_id: CWE-552
description: CWE-552 Files or Directories Accessible to External Parties
Affected products: vendor: Unknown
product: SEUR Oficial
Credits: lang: en
value: José Aguilera
Published: 2022-02-07T15:47:15.000Z
CVE-2021-25005 SEUR Oficial < 1.7.0 - Admin+ Stored Cross-Site Scripting
The SEUR Oficial WordPress plugin before 1.7.0 does not sanitize and escape some of its settings allowing high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed
Problem types: cwe_id: CWE-79
description: CWE-79 Cross-site Scripting (XSS)
Affected products: vendor: Unknown
product: SEUR Oficial
Credits: lang: en
value: José Aguilera
Published: 2022-01-17T13:00:30.000Z
CVE-2021-25006 MOLIE  <= 0.5 - Reflected Cross-Site Scripting
The MOLIE WordPress plugin through 0.5 does not escape the course_id parameter before outputting it back in the admin dashboard, leading to a Reflected Cross-Site Scripting issue
Problem types: cwe_id: CWE-79
description: CWE-79 Cross-site Scripting (XSS)
Affected products: vendor: Unknown
product: MOLIE – Instructure Canvas Linking tool
Credits: lang: en
value: Jeremie Amsellem
Published: 2022-03-14T14:41:13.000Z
CVE-2021-25007 MOLIE <= 0.5 - Authenticated SQL Injection
The MOLIE WordPress plugin through 0.5 does not validate and escape a post parameter before using in a SQL statement, leading to an SQL Injection
Problem types: cwe_id: CWE-89
description: CWE-89 SQL Injection
Affected products: vendor: Unknown
product: MOLIE – Instructure Canvas Linking tool
Credits: lang: en
value: Jeremie Amsellem
Published: 2022-03-14T14:41:14.000Z
CVE-2021-25008 Code Snippets < 2.14.3 - Reflected Cross-Site Scripting
The Code Snippets WordPress plugin before 2.14.3 does not escape the snippets-safe-mode parameter before outputting it back in attributes, leading to a Reflected Cross-Site Scripting issue
Problem types: cwe_id: CWE-79
description: CWE-79 Cross-site Scripting (XSS)
Affected products: vendor: Unknown
product: Code Snippets
Credits: lang: en
value: Krzysztof Zając
Published: 2022-01-24T08:01:07.000Z
CVE-2021-25009 CorreosExpress <= 2.6.0 - Sensitive Information Disclosure
The CorreosExpress WordPress plugin through 2.6.0 generates log files which are publicly accessible, and contain sensitive information such as sender/receiver names, phone numbers, physical and email addresses
Problem types: cwe_id: CWE-532
description: CWE-532 Insertion of Sensitive Information into Log File
Affected products: vendor: Unknown
product: CorreosExpress – Shipping Management – Tags
Credits: lang: en
value: José Aguilera
Published: 2022-03-07T08:16:13.000Z
CVE-2021-25010 Post Snippets < 3.1.4 - CSRF to Stored Cross-Site Scripting
The Post Snippets WordPress plugin before 3.1.4 does not have CSRF check when importing files, allowing attacker to make a logged In admin import arbitrary snippets. Furthermore, imported snippers are not sanitised and escaped, which could lead to Stored Cross-Site Scripting issues
Problem types: cwe_id: CWE-352
description: CWE-352 Cross-Site Request Forgery (CSRF)
Affected products: vendor: Unknown
product: Post Snippets
Credits: lang: en
value: Muhammad Adel
Published: 2022-02-28T09:06:28.000Z
CVE-2021-25011 WP Google Map < 1.8.1 - Subscriber+ Arbitrary Post Deletion and Plugin's Settings Update
The Maps Plugin using Google Maps for WordPress plugin before 1.8.1 does not have proper authorisation and CSRF in most of its AJAX actions, which could allow any authenticated users, such as subscriber to delete arbitrary posts and update the plugin's settings.
Problem types: cwe_id: CWE-862
description: CWE-862 Missing Authorization
Affected products: vendor: Unknown
product: Maps Plugin using Google Maps for WordPress – WP Google Map
Credits: lang: en
value: Krzysztof Zając
Published: 2022-02-28T09:06:30.000Z
CVE-2021-25012 Pz-LinkCard <= 2.4.4.4 - Reflected Cross-Site Scripting
The Pz-LinkCard WordPress plugin through 2.4.4.4 does not sanitise and escape multiple parameters before outputting them back in admin dashboard pages, leading to Reflected Cross-Site Scripting issues
Problem types: cwe_id: CWE-79
description: CWE-79 Cross-site Scripting (XSS)
Affected products: vendor: Unknown
product: Pz-LinkCard
Credits: lang: en
value: Krzysztof Zając
Published: 2022-03-28T17:21:28.000Z
CVE-2021-25013 Qubely < 1.7.8 - Subscriber+ Arbitrary Post Deletion
The Qubely WordPress plugin before 1.7.8 does not have authorisation and CSRF check on the qubely_delete_saved_block AJAX action, and does not ensure that the block to be deleted belong to the plugin, as a result, any authenticated users, such as subscriber can delete arbitrary posts
Problem types: cwe_id: CWE-862
description: CWE-862 Missing Authorization
Affected products: vendor: Unknown
product: Qubely – Advanced Gutenberg Blocks
Credits: lang: en
value: Krzysztof Zając
Published: 2022-01-24T08:01:08.000Z
CVE-2021-25014 Ibtana < 1.1.4.9 - Subscriber+ Settings Update to Stored XSS
The Ibtana WordPress plugin before 1.1.4.9 does not have authorisation and CSRF checks in the ive_save_general_settings AJAX action, allowing any authenticated users, such as subscriber to call it and change the plugin's settings which could lead to Stored Cross-Site Scripting issue.
Problem types: cwe_id: CWE-862
description: CWE-862 Missing Authorization
Affected products: vendor: Unknown
product: Ibtana – WordPress Website Builder
Credits: lang: en
value: Krzysztof Zając
Published: 2022-02-14T09:20:42.000Z
CVE-2021-25015 myCred < 2.4 - Reflected Cross-Site Scripting
The myCred WordPress plugin before 2.4 does not sanitise and escape the search query before outputting it back in the history dashboard page, leading to a Reflected Cross-Site Scripting issue
Problem types: cwe_id: CWE-79
description: CWE-79 Cross-site Scripting (XSS)
Affected products: vendor: Unknown
product: myCred – Points, Rewards, Gamification, Ranks, Badges & Loyalty Plugin
Credits: lang: en
value: Krzysztof Zając
Published: 2022-01-24T08:01:09.000Z
CVE-2021-25016 Chaty < 2.8.3 - Reflected Cross-Site Scripting
The Chaty WordPress plugin before 2.8.3 and Chaty Pro WordPress plugin before 2.8.2 do not sanitise and escape the search parameter before outputting it back in the admin dashboard, leading to a Reflected Cross-Site Scripting
Problem types: cwe_id: CWE-79
description: CWE-79 Cross-site Scripting (XSS)
Affected products: vendor: Unknown
product: Floating Chat Widget: Contact Icons, Messages, Telegram, Email, SMS, Call Button – Chaty
vendor: Unknown
product: Floating Chat Widget Pro - Chaty Pro
Credits: lang: en
value: Krzysztof Zając
Published: 2022-01-03T12:49:12.000Z
CVE-2021-25017 Tutor LMS < 1.9.12 - Reflected Cross-Site Scripting
The Tutor LMS WordPress plugin before 1.9.12 does not escape the search parameter before outputting it back in an attribute in an admin page, leading to a Reflected Cross-Site Scripting
Problem types: cwe_id: CWE-79
description: CWE-79 Cross-site Scripting (XSS)
Affected products: vendor: Unknown
product: Tutor LMS – eLearning and online course solution
Credits: lang: en
value: Krzysztof Zając
Published: 2022-01-24T08:01:11.000Z
CVE-2021-25018 PPOM for WooCommerce < 24.0 - Subscriber+ Settings Update to Stored XSS
The PPOM for WooCommerce WordPress plugin before 24.0 does not have authorisation and CSRF checks in the ppom_settings_panel_action AJAX action, allowing any authenticated to call it and set arbitrary settings. Furthermore, due to the lack of sanitisation and escaping, it could lead to Stored XSS issues
Problem types: cwe_id: CWE-862
description: CWE-862 Missing Authorization
Affected products: vendor: Unknown
product: PPOM for WooCommerce
Credits: lang: en
value: Krzysztof Zając
Published: 2022-02-14T09:20:43.000Z
CVE-2021-25019 SEO Plugin by Squirrly SEO < 11.1.12 - Reflected Cross-Site Scripting
The SEO Plugin by Squirrly SEO WordPress plugin before 11.1.12 does not escape the type parameter before outputting it back in an attribute in an admin page, leading to a Reflected Cross-Site Scripting
Problem types: cwe_id: CWE-79
description: CWE-79 Cross-site Scripting (XSS)
Affected products: vendor: Unknown
product: SEO Plugin by Squirrly SEO
Credits: lang: en
value: Krzysztof Zając
Published: 2022-03-21T18:55:39.000Z
CVE-2021-25020 CAOS < 4.1.9 - Admin+ Arbitrary Folder Deletion via Path Traversal
The CAOS | Host Google Analytics Locally WordPress plugin before 4.1.9 does not validate the cache directory setting, allowing high privilege users to use a path traversal vector and delete arbitrary folders when uninstalling the plugin
Problem types: cwe_id: CWE-22
description: CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Affected products: vendor: Unknown
product: CAOS | Host Google Analytics Locally
Credits: lang: en
value: José Aguilera
Published: 2022-01-03T12:49:13.000Z
CVE-2021-25021 OMGF < 4.5.12 - Admin+ Arbitrary Folder Deletion via Path Traversal
The OMGF | Host Google Fonts Locally WordPress plugin before 4.5.12 does not validate the cache directory setting, allowing high privilege users to use a path traversal vector and delete arbitrary folders when uninstalling the plugin
Problem types: cwe_id: CWE-22
description: CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Affected products: vendor: Unknown
product: OMGF | Host Google Fonts Locally
Credits: lang: en
value: José Aguilera
Published: 2022-01-03T12:49:14.000Z
CVE-2021-25022 UpdraftPlus < 1.16.66 - Reflected Cross-Site Scripting
The UpdraftPlus WordPress Backup Plugin WordPress plugin before 1.16.66 does not sanitise and escape the backup_timestamp and job_id parameter before outputting then back in admin pages, leading to Reflected Cross-Site Scripting issues
Problem types: cwe_id: CWE-79
description: CWE-79 Cross-site Scripting (XSS)
Affected products: vendor: Unknown
product: UpdraftPlus WordPress Backup Plugin
Credits: lang: en
value: Krzysztof Zając
Published: 2022-01-03T12:49:15.000Z
CVE-2021-25023 Speed Booster Pack < 4.3.3.1 - Admin+ SQL Injection
The Speed Booster Pack ⚡ PageSpeed Optimization Suite WordPress plugin before 4.3.3.1 does not escape the sbp_convert_table_name parameter before using it in a SQL statement to convert the related table, leading to an SQL injection
Problem types: cwe_id: CWE-89
description: CWE-89 SQL Injection
Affected products: vendor: Unknown
product: Speed Booster Pack ⚡ PageSpeed Optimization Suite
Credits: lang: en
value: Quan
lang: en
value: Hoang Xuan
Published: 2022-01-03T12:49:15.000Z
CVE-2021-25024 Event Calendar < 1.1.51 - Reflected Cross-Site Scripting
The EventCalendar WordPress plugin before 1.1.51 does not escape some user input before outputting it back in attributes, leading to Reflected Cross-SIte Scripting issues
Problem types: cwe_id: CWE-79
description: CWE-79 Cross-site Scripting (XSS)
Affected products: vendor: Unknown
product: EventCalendar
Credits: lang: en
value: Krzysztof Zając
Published: 2022-01-17T13:00:31.000Z
CVE-2021-25025 Event Calendar < 1.1.51 - Subscriber+ Event Creation
The EventCalendar WordPress plugin before 1.1.51 does not have proper authorisation and CSRF checks in the add_calendar_event AJAX actions, allowing users with a role as low as subscriber to create events
Problem types: cwe_id: CWE-352
description: CWE-352 Cross-Site Request Forgery (CSRF)
cwe_id: CWE-862
description: CWE-862 Missing Authorization
Affected products: vendor: Unknown
product: EventCalendar
Credits: lang: en
value: Krzysztof Zając
Published: 2022-01-17T00:00:00.000Z
CVE-2021-25026 Patreon WordPress < 1.8.2 - Admin+ Stored Cross-Site Scripting
The Patreon WordPress plugin before 1.8.2 does not sanitise and escape the field "Custom Patreon Page name", which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed
Problem types: cwe_id: CWE-79
description: CWE-79 Cross-site Scripting (XSS)
Affected products: vendor: Unknown
product: Patreon WordPress
Credits: lang: en
value: José Aguilera
Published: 2022-03-14T14:41:16.000Z
CVE-2021-25027 PowerPack Addons for Elementor < 2.6.2 - Reflected Cross-Site Scripting
The PowerPack Addons for Elementor WordPress plugin before 2.6.2 does not escape the tab parameter before outputting it back in an attribute in the admin dashboard, leading to a Reflected Cross-Site Scripting issue
Problem types: cwe_id: CWE-79
description: CWE-79 Cross-site Scripting (XSS)
Affected products: vendor: Unknown
product: PowerPack Addons for Elementor
Credits: lang: en
value: Krzysztof Zając
Published: 2022-01-03T12:49:16.000Z
CVE-2021-25028 Event Tickets < 5.2.2 - Open Redirect
The Event Tickets WordPress plugin before 5.2.2 does not validate the tribe_tickets_redirect_to parameter before redirecting the user to the given value, leading to an arbitrary redirect issue
Problem types: cwe_id: CWE-601
description: CWE-601 URL Redirection to Untrusted Site ('Open Redirect')
Affected products: vendor: Unknown
product: Event Tickets
Credits: lang: en
value: Krzysztof Zając
Published: 2022-01-24T08:01:12.000Z
CVE-2021-25029 Cluevo < 1.8.1 - Admin+ Stored Cross Site Scripting
The CLUEVO LMS, E-Learning Platform WordPress plugin before 1.8.1 does not sanitise and escape Course's module, which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed
Problem types: cwe_id: CWE-79
description: CWE-79 Cross-site Scripting (XSS)
Affected products: vendor: Unknown
product: CLUEVO LMS, E-Learning Platform
Credits: lang: en
value: Rutuja D Shirke
Published: 2022-02-07T15:47:16.000Z
CVE-2021-25030 Events Made Easy < 2.2.36 - Subscriber+ SQL Injection
The Events Made Easy WordPress plugin before 2.2.36 does not sanitise and escape the search_text parameter before using it in a SQL statement via the eme_searchmail AJAX action, available to any authenticated users. As a result, users with a role as low as subscriber can call it and perform SQL injection attacks
Problem types: cwe_id: CWE-89
description: CWE-89 SQL Injection
Affected products: vendor: Unknown
product: Events Made Easy
Credits: lang: en
value: Krzysztof Zając
Published: 2022-01-03T12:49:17.000Z
CVE-2021-25031 Image Hover Effects Ultimate < 9.7.1 - Reflected Cross-Site Scripting
The Image Hover Effects Ultimate (Image Gallery, Effects, Lightbox, Comparison or Magnifier) WordPress plugin before 9.7.1 does not escape the effects parameter before outputting it back in an attribute in an admin page, leading to a Reflected Cross-Site Scripting
Problem types: cwe_id: CWE-79
description: CWE-79 Cross-site Scripting (XSS)
Affected products: vendor: Unknown
product: Image Hover Effects Ultimate (Image Gallery, Effects, Lightbox, Comparison or Magnifier)
Credits: lang: en
value: Krzysztof Zając
Published: 2022-01-24T08:01:14.000Z
CVE-2021-25032 PublishPress Capabilities < 2.3.1 - Unauthenticated Arbitrary Options Update to Blog Compromise
The PublishPress Capabilities WordPress plugin before 2.3.1, PublishPress Capabilities Pro WordPress plugin before 2.3.1 does not have authorisation and CSRF checks when updating the plugin's settings via the init hook, and does not ensure that the options to be updated belong to the plugin. As a result, unauthenticated attackers could update arbitrary blog options, such as the default role and make any new registered user with an administrator role.
Problem types: cwe_id: CWE-352
description: CWE-352 Cross-Site Request Forgery (CSRF)
cwe_id: CWE-862
description: CWE-862 Missing Authorization
Affected products: vendor: Unknown
product: PublishPress Capabilities – User Role Access, Editor Permissions, Admin Menus
vendor: Unknown
product: PublishPress Capabilities Pro
Credits: lang: en
value: Krzysztof Zając
Published: 2022-01-10T00:00:00.000Z
CVE-2021-25033 Noptin < 1.6.5 - Open Redirect
The WordPress Newsletter Plugin WordPress plugin before 1.6.5 does not validate the to parameter before redirecting the user to its given value, leading to an open redirect issue
Problem types: cwe_id: CWE-601
description: CWE-601 URL Redirection to Untrusted Site ('Open Redirect')
Affected products: vendor: Unknown
product: WordPress Newsletter Plugin – Noptin
Credits: lang: en
value: Trang LKB
Published: 2022-02-14T09:20:45.000Z
CVE-2021-25034 WP User < 7.0 - Reflected Cross-Site Scripting
The WP User WordPress plugin before 7.0 does not sanitise and escape some parameters in pages where the [wp_user] shortcode is used, leading to Reflected Cross-Site Scripting issues
Problem types: cwe_id: CWE-79
description: CWE-79 Cross-site Scripting (XSS)
Affected products: vendor: Unknown
product: WP User – Custom Registration Forms, Login and User Profile
Credits: lang: en
value: Jeremie Amsellem
Published: 2022-02-28T09:06:32.000Z
CVE-2021-25035 Backup and Staging by WP Time Capsule < 1.22.7 - Reflected Cross-Site Scripting
The Backup and Staging by WP Time Capsule WordPress plugin before 1.22.7 does not sanitise and escape the error parameter before outputting it back in an admin page, leading to a Reflected Cross-Site Scripting
Problem types: cwe_id: CWE-79
description: CWE-79 Cross-site Scripting (XSS)
Affected products: vendor: Unknown
product: Backup and Staging by WP Time Capsule
Credits: lang: en
value: Jeremie Amsellem
Published: 2022-01-24T08:01:15.000Z
CVE-2021-25036 All In One SEO < 4.1.5.3 - Authenticated Privilege Escalation
The All in One SEO WordPress plugin before 4.1.5.3 is affected by a Privilege Escalation issue, which was discovered during an internal audit by the Jetpack Scan team, and may grant bad actors access to protected REST API endpoints they shouldn’t have access to. This could ultimately enable users with low-privileged accounts, like subscribers, to perform remote code execution on affected sites.
Problem types: cwe_id: CWE-287
description: CWE-287 Improper Authentication
Affected products: vendor: Unknown
product: All in One SEO – Best WordPress SEO Plugin – Easily Improve SEO Rankings & Increase Traffic
Credits: lang: en
value: Marc Montpas (Jetpack Scan)
Published: 2022-01-17T13:00:34.000Z
CVE-2021-25037 All In One SEO < 4.1.5.3 - Authenticated SQL Injection
The All in One SEO WordPress plugin before 4.1.5.3 is affected by an authenticated SQL injection issue, which was discovered during an internal audit by the Jetpack Scan team, and could grant attackers access to privileged information from the affected site’s database (e.g., usernames and hashed passwords).
Problem types: cwe_id: CWE-89
description: CWE-89 SQL Injection
Affected products: vendor: Unknown
product: All in One SEO – Best WordPress SEO Plugin – Easily Improve SEO Rankings & Increase Traffic
Credits: lang: en
value: Marc Montpas (Jetpack Scan)
Published: 2022-01-17T13:00:36.000Z
CVE-2021-25038 Multisite User Sync/Unsync < 2.1.2 - Reflected Cross-Site Scripting
The WordPress Multisite User Sync/Unsync WordPress plugin before 2.1.2 does not sanitise and escape the wmus_source_blog and wmus_record_per_page parameters before outputting them back in attributes, leading to Reflected Cross-Site Scripting issues
Problem types: cwe_id: CWE-79
description: CWE-79 Cross-site Scripting (XSS)
Affected products: vendor: Unknown
product: WordPress Multisite User Sync/Unsync
Credits: lang: en
value: Asif Nawaz Minhas
Published: 2022-03-07T08:16:15.000Z
CVE-2021-25039 Multisite Content Copier/Updater < 2.1.0 - Reflected Cross-Site Scripting
The WordPress Multisite Content Copier/Updater WordPress plugin before 2.1.0 does not sanitise and escape the wmcc_content_type, wmcc_source_blog and wmcc_record_per_page parameters before outputting them back in attributes, leading to Reflected Cross-Site Scripting issues
Problem types: cwe_id: CWE-79
description: CWE-79 Cross-site Scripting (XSS)
Affected products: vendor: Unknown
product: WordPress Multisite Content Copier/Updater
Credits: lang: en
value: Asif Nawaz Minhas
Published: 2022-03-07T08:16:16.000Z
CVE-2021-25040 Booking Calendar < 8.9.2 - Reflected Cross-Site Scripting
The Booking Calendar WordPress plugin before 8.9.2 does not sanitise and escape the booking_type parameter before outputting it back in an admin page, leading to a Reflected Cross-Site Scripting
Problem types: cwe_id: CWE-79
description: CWE-79 Cross-site Scripting (XSS)
Affected products: vendor: Unknown
product: Booking Calendar
Credits: lang: en
value: Krzysztof Zając
Published: 2022-01-03T12:49:18.000Z
CVE-2021-25041 Photo Gallery by 10Web < 1.5.68 - Reflected Cross-Site Scripting (XSS)
The Photo Gallery by 10Web WordPress plugin before 1.5.68 is vulnerable to Reflected Cross-Site Scripting (XSS) issues via the bwg_album_breadcrumb_0 and shortcode_id GET parameters passed to the bwg_frontend_data AJAX action
Problem types: cwe_id: CWE-79
description: CWE-79 Cross-site Scripting (XSS)
Affected products: vendor: Unknown
product: Photo Gallery by 10Web – Mobile-Friendly Image Gallery
Credits: lang: en
value: ThuraMoeMyint
Published: 2021-12-06T15:55:40.000Z