rainbutterfly/cve_corpus huggingface dataset:
CVE-2021-25042 WP Visitor Statistics (Real Time Traffic) < 5.5 - Arbitrary IP Address Exclusion to Stored XSS
The WP Visitor Statistics (Real Time Traffic) WordPress plugin before 5.5 does not have authorisation and CSRF checks in the updateIpAddress AJAX action, allowing any authenticated user to call it, or make a logged in user do it via a CSRF attack and add an arbitrary IP address to exclude. Furthermore, due to the lack of validation, sanitisation and escaping, users could set a malicious value and perform Cross-Site Scripting attacks against logged in admin
Problem types: cwe_id: CWE-862
description: CWE-862 Missing Authorization
Affected products: vendor: Unknown
product: WP Visitor Statistics (Real Time Traffic)
Credits: lang: en
value: Krzysztof Zając
Published: 2022-02-28T09:06:33.000Z
CVE-2021-25043 WOOCS < 1.3.7.3 - Reflected Cross-Site Scripting
The WOOCS WordPress plugin before 1.3.7.3 does not sanitise and escape the custom_prices parameter before outputting it back in the response, leading to a Reflected Cross-Site Scripting issue
Problem types: cwe_id: CWE-79
description: CWE-79 Cross-site Scripting (XSS)
Affected products: vendor: Unknown
product: WOOCS – Currency Switcher for WooCommerce. Professional and Free multi currency plugin – Pay in selected currency
Credits: lang: en
value: Krzysztof Zając
Published: 2022-01-10T15:30:33.000Z
CVE-2021-25044 Cryptocurrency Pricing list and Ticker <= 1.5 - Reflected Cross-Site Scripting
The Cryptocurrency Pricing list and Ticker WordPress plugin through 1.5 does not sanitise and escape the ccpw_setpage parameter before outputting it back in pages where its shortcode is embed, leading to a Reflected Cross-Site Scripting issue
Problem types: cwe_id: CWE-79
description: CWE-79 Cross-Site Scripting (XSS)
Affected products: vendor: Unknown
product: Cryptocurrency Pricing list and Ticker
Credits: lang: en
value: Jeremie Amsellem
Published: 2022-10-10T00:00:00.000Z
CVE-2021-25045 Asgaros Forum < 1.15.15 - Admin+ SQL Injection via forum_id
The Asgaros Forum WordPress plugin before 1.15.15 does not validate or escape the forum_id parameter before using it in a SQL statement when editing a forum, leading to an SQL injection issue
Problem types: cwe_id: CWE-89
description: CWE-89 SQL Injection
Affected products: vendor: Unknown
product: Asgaros Forum
Credits: lang: en
value: Trang LKB
Published: 2022-01-24T08:01:16.000Z
CVE-2021-25046 Modern Events Calendar Lite < 6.2.0 - Subscriber+ Category Add Leading to Stored XSS
The Modern Events Calendar Lite WordPress plugin before 6.2.0 alloed any logged-in user, even a subscriber user, may add a category whose parameters are incorrectly escaped in the admin panel, leading to stored XSS.
Problem types: cwe_id: CWE-79
description: CWE-79 Cross-site Scripting (XSS)
Affected products: vendor: Unknown
product: Modern Events Calendar Lite
Credits: lang: en
value: Krzysztof Zając
Published: 2022-01-17T13:00:37.000Z
CVE-2021-25047 10Web Social Photo Feed < 1.4.29 - Reflected Cross-Site Scripting (XSS)
The 10Web Social Photo Feed WordPress plugin before 1.4.29 was affected by a reflected Cross-Site Scripting (XSS) vulnerability in the wdi_apply_changes admin page, allowing an attacker to perform such attack against any logged in users
Problem types: cwe_id: CWE-79
description: CWE-79 Cross-site Scripting (XSS)
Affected products: vendor: Unknown
product: 10Web Social Photo Feed
Credits: lang: en
value: Krzysztof Zając
Published: 2022-01-10T15:30:34.000Z
CVE-2021-25048 KingComposer <= 2.9.6 - Subscriber+ Stored Cross-Site Scripting
The KingComposer WordPress plugin through 2.9.6 does not have authorisation, CSRF and sanitisation/escaping when creating profile, allowing any authenticated users to create arbitrary ones, with Cross-Site Scripting payloads in them
Problem types: cwe_id: CWE-79
description: CWE-79 Cross-site Scripting (XSS)
Affected products: vendor: Unknown
product: Page Builder: KingComposer – Free Drag and Drop page builder by King-Theme
Credits: lang: en
value: Krzysztof Zając
Published: 2022-04-04T15:35:37.000Z
CVE-2021-25049 Mobile Events Manager < 1.4.4 - Admin+ Stored Cross-Site Scripting
The Mobile Events Manager WordPress plugin before 1.4.4 does not sanitise and escape various of its settings, allowing high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed
Problem types: cwe_id: CWE-79
description: CWE-79 Cross-site Scripting (XSS)
Affected products: vendor: Unknown
product: Mobile Events Manager
Credits: lang: en
value: Varun thorat
Published: 2022-01-24T08:01:18.000Z
CVE-2021-25050 Remove Footer Credit < 1.0.11 - Admin+ Stored Cross-Site Scripting
The Remove Footer Credit WordPress plugin before 1.0.11 does properly sanitise its settings, allowing high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html is disallowed.
Problem types: cwe_id: CWE-79
description: CWE-79 Cross-site Scripting (XSS)
Affected products: vendor: Unknown
product: Remove Footer Credit
Credits: lang: en
value: apple502j
Published: 2022-02-14T09:20:46.000Z
CVE-2021-25051 Modal Window < 5.2.2 - RFI leading to RCE via CSRF
The Modal Window WordPress plugin before 5.2.2 within the wow-company admin menu page allows to include() arbitrary file with PHP extension (as well as with data:// or http:// protocols), thus leading to CSRF RCE.
Problem types: cwe_id: CWE-352
description: CWE-352 Cross-Site Request Forgery (CSRF)
Affected products: vendor: Unknown
product: Modal Window – create popup modal window
Credits: lang: en
value: Krzysztof Zając
Published: 2022-01-10T15:30:35.000Z
CVE-2021-25052 Button Generator < 2.3.3 - RFI leading to RCE via CSRF
The Button Generator WordPress plugin before 2.3.3 within the wow-company admin menu page allows to include() arbitrary file with PHP extension (as well as with data:// or http:// protocols), thus leading to CSRF RCE.
Problem types: cwe_id: CWE-352
description: CWE-352 Cross-Site Request Forgery (CSRF)
Affected products: vendor: Unknown
product: Button Generator – easily Button Builder
Credits: lang: en
value: Krzysztof Zając
Published: 2022-01-10T15:30:36.000Z
CVE-2021-25053 WP Coder < 2.5.2 - RFI leading to RCE via CSRF
The WP Coder WordPress plugin before 2.5.2 within the wow-company admin menu page allows to include() arbitrary file with PHP extension (as well as with data:// or http:// protocols), thus leading to CSRF RCE.
Problem types: cwe_id: CWE-352
description: CWE-352 Cross-Site Request Forgery (CSRF)
Affected products: vendor: Unknown
product: WP Coder – add custom html, css and js code
Credits: lang: en
value: Krzysztof Zając
Published: 2022-01-10T15:30:36.000Z
CVE-2021-25054 WPcalc <= 2.1 - Authenticated SQL Injection
The WPcalc WordPress plugin through 2.1 does not sanitize user input into the 'did' parameter and uses it in a SQL statement, leading to an authenticated SQL Injection vulnerability.
Problem types: cwe_id: CWE-89
description: CWE-89 SQL Injection
Affected products: vendor: Unknown
product: WPcalc – create any online calculators
Credits: lang: en
value: 0xdecafbad
Published: 2022-01-10T15:30:37.000Z
CVE-2021-25055 FeedWordPress < 2022.0123 - Reflected Cross-Site Scripting (XSS)
The FeedWordPress plugin before 2022.0123 is affected by a Reflected Cross-Site Scripting (XSS) within the "visibility" parameter.
Problem types: cwe_id: CWE-79
description: CWE-79 Cross-site Scripting (XSS)
Affected products: vendor: Unknown
product: FeedWordPress
Credits: lang: en
value: Hung Chien
Published: 2022-02-21T10:45:42.000Z
CVE-2021-25056 Ninja Forms < 3.6.10 - Admin+ Stored Cross-Site Scripting
The Ninja Forms Contact Form WordPress plugin before 3.6.10 does not sanitise and escape field labels, allowing high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed.
Problem types: cwe_id: CWE-79
description: CWE-79 Cross-site Scripting (XSS)
Affected products: vendor: Unknown
product: Ninja Forms Contact Form – The Drag and Drop Form Builder for WordPress
Credits: lang: en
value: Muhammad Adel
Published: 2022-07-04T13:05:21.000Z
CVE-2021-25057 Translation Exchange <= 1.0.14 - Authenticated Stored Cross-Site Scripting (XSS)
The Translation Exchange WordPress plugin through 1.0.14 was vulnerable to Authenticated Stored Cross-Site Scripting (XSS) within the Project Key text field found in the plugin's settings.
Problem types: cwe_id: CWE-79
description: CWE-79 Cross-site Scripting (XSS)
Affected products: vendor: Unknown
product: Translation Exchange – Translate Your WordPress Site In Minutes!
Credits: lang: en
value: Rutuja D Shirke
Published: 2022-02-21T10:45:44.000Z
CVE-2021-25058 The Buffer Button <= 1.0 - Authenticated Stored Cross Site Scripting (XSS)
The Buffer Button WordPress plugin through 1.0 was vulnerable to Authenticated Stored Cross Site Scripting (XSS) within the Twitter username to mention text field.
Problem types: cwe_id: CWE-79
description: CWE-79 Cross-site Scripting (XSS)
Affected products: vendor: Unknown
product: The Buffer Button
Credits: lang: en
value: Rutuja D Shirke
Published: 2022-02-21T10:45:45.000Z
CVE-2021-25059 Download Plugin < 2.0.0 - Subscriber+ Website Download
The Download Plugin WordPress plugin before 2.0.0 does not properly validate a user has the required privileges to access a backup's nonce identifier, which may allow any users with an account on the site (such as subscriber) to download a full copy of the website.
Problem types: description: CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Affected products: vendor: Unknown
product: Download Plugin
default_status: unaffected
Credits: lang: en
value: apple502j
Published: 2022-11-28T13:47:09.324Z
CVE-2021-25060 Five Star Business Profile and Schema < 2.1.7 - Subscriber+ Page Creation & Settings Update to Stored XSS
The Five Star Business Profile and Schema WordPress plugin before 2.1.7 does not have any authorisation and CSRF in its bpfwp_welcome_add_contact_page and bpfwp_welcome_set_contact_information AJAX action, allowing any authenticated users, such as subscribers, to call them. Furthermore, due to the lack of sanitisation, it also lead to Stored Cross-Site Scripting issues
Problem types: cwe_id: CWE-79
description: CWE-79 Cross-site Scripting (XSS)
Affected products: vendor: Unknown
product: Five Star Business Profile and Schema
Credits: lang: en
value: Krzysztof Zając
Published: 2022-02-21T10:45:47.000Z
CVE-2021-25061 WP Booking System – Booking Calendar < 2.0.15 - Authenticated Reflected Cross-Site Scripting (XSS)
The WP Booking System WordPress plugin before 2.0.15 was affected by a reflected xss in wp-booking-system on the wpbs-calendars admin page.
Problem types: cwe_id: CWE-79
description: CWE-79 Cross-site Scripting (XSS)
Affected products: vendor: Unknown
product: WP Booking System – Booking Calendar
Credits: lang: en
value: Krzysztof Zając
Published: 2022-01-17T13:00:39.000Z
CVE-2021-25062 Orders Tracking for WooCommerce < 1.1.10 - Reflected Cross-Site Scripting
The Orders Tracking for WooCommerce WordPress plugin before 1.1.10 does not sanitise and escape the file_url before outputting it back in an admin page, leading to a Reflected Cross-Site Scripting
Problem types: cwe_id: CWE-79
description: CWE-79 Cross-site Scripting (XSS)
Affected products: vendor: Unknown
product: Orders Tracking for WooCommerce
Credits: lang: en
value: Krzysztof Zając
Published: 2022-01-24T08:01:20.000Z
CVE-2021-25063 Contact Form 7 Skins < 2.5.1 - Reflected Cross-Site Scripting (XSS)
The Skins for Contact Form 7 WordPress plugin before 2.5.1 does not sanitise and escape the tab parameter before outputting it back in an admin page, leading to a Reflected Cross-Site Scripting
Problem types: cwe_id: CWE-79
description: CWE-79 Cross-site Scripting (XSS)
Affected products: vendor: Unknown
product: Skins for Contact Form 7
Credits: lang: en
value: Krzysztof Zając
Published: 2022-02-01T12:21:35.000Z
CVE-2021-25064 Wow Countdowns <= 3.1.2 - Admin+ SQLi
The Wow Countdowns WordPress plugin through 3.1.2 does not sanitize user input into the 'did' parameter and uses it in a SQL statement, leading to an authenticated SQL Injection.
Problem types: cwe_id: CWE-89
description: CWE-89 SQL Injection
Affected products: vendor: Unknown
product: Wow Countdowns – easily create any countdowns, counters and timers
Credits: lang: en
value: 0xdecafbad
Published: 2022-03-28T17:21:42.000Z
CVE-2021-25065 Smash Balloon Social Post Feed < 4.1.1 - Authenticated Reflected Cross-Site Scripting (XSS)
The Smash Balloon Social Post Feed WordPress plugin before 4.1.1 was affected by a reflected XSS in custom-facebook-feed in cff-top admin page.
Problem types: cwe_id: CWE-79
description: CWE-79 Cross-site Scripting (XSS)
Affected products: vendor: Unknown
product: Smash Balloon Social Post Feed
Credits: lang: en
value: Krzysztof Zając
Published: 2022-01-17T13:00:40.000Z
CVE-2021-25066 Ninja Forms < 3.6.10 - Admin+ Stored Cross-Site Scripting via Import
The Ninja Forms Contact Form WordPress plugin before 3.6.10 does not sanitize and escape some imported data, allowing high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed.
Problem types: cwe_id: CWE-79
description: CWE-79 Cross-site Scripting (XSS)
Affected products: vendor: Unknown
product: Ninja Forms Contact Form – The Drag and Drop Form Builder for WordPress
Credits: lang: en
value: Muhammad Adel
Published: 2022-07-04T13:05:27.000Z
CVE-2021-25067 Landing Page Builder < 1.4.9.6 - Authenticated Reflected Cross-Site Scripting (XSS)
The Landing Page Builder WordPress plugin before 1.4.9.6 was affected by a reflected XSS in page-builder-add on the ulpb_post admin page.
Problem types: cwe_id: CWE-79
description: CWE-79 Cross-site Scripting (XSS)
Affected products: vendor: Unknown
product: Landing Page Builder – Lead Page – Optin Page – Squeeze Page – WordPress Landing Pages
Credits: lang: en
value: Krzysztof Zając
Published: 2022-01-17T13:00:41.000Z
CVE-2021-25068 Sync WooCommerce Product feed to Google Shopping <= 1.2.4 - Admin+ SQLi
The Sync WooCommerce Product feed to Google Shopping WordPress plugin through 1.2.4 uses the 'feed_id' POST parameter which is not properly sanitized for use in a SQL statement, leading to a SQL injection vulnerability in the admin dashboard
Problem types: cwe_id: CWE-89
description: CWE-89 SQL Injection
Affected products: vendor: Unknown
product: Sync WooCommerce Product feed to Google Shopping
Credits: lang: en
value: 0xdecafbad
Published: 2022-03-28T17:21:55.000Z
CVE-2021-25069 WordPress Download Manager < 3.2.34 - Authenticated SQL Injection to Reflected XSS
The Download Manager WordPress plugin before 3.2.34 does not sanitise and escape the package_ids parameter before using it in a SQL statement, leading to a SQL injection, which can also be exploited to cause a Reflected Cross-Site Scripting issue
Problem types: cwe_id: CWE-89
description: CWE-89 SQL Injection
Affected products: vendor: Unknown
product: Download Manager
Credits: lang: en
value: Krzysztof Zając
Published: 2022-02-21T10:45:48.000Z
CVE-2021-25070 WP Block and Stop Bad Bots < 6.88 - Unauthenticated SQLi
The Block Bad Bots WordPress plugin before 6.88 does not properly sanitise and escape the User Agent before using it in a SQL statement to record logs, leading to an SQL Injection issue
Problem types: cwe_id: CWE-89
description: CWE-89 SQL Injection
Affected products: vendor: Unknown
product: Block Bad Bots and Stop Bad Bots Crawlers and Spiders and Anti Spam Protection
Credits: lang: en
value: Krzysztof Zając
Published: 2022-03-28T17:22:09.000Z
CVE-2021-25071 Akismet Privacy Policies <= 2.0.1 - Reflected Cross-Site Scripting
The WordPress plugin through 2.0.1 does not sanitise and escape the translation parameter before outputting it back in an admin page, leading to a Reflected Cross-Site Scripting
Problem types: cwe_id: CWE-79
description: CWE-79 Cross-site Scripting (XSS)
Affected products: vendor: Unknown
product: Akismet Privacy Policies
Credits: lang: en
value: Krzysztof Zając
Published: 2022-03-28T17:22:23.000Z
CVE-2021-25072 NextScripts: Social Networks Auto-Poster < 4.3.25 - Arbitrary Post Deletion via CSRF
The NextScripts: Social Networks Auto-Poster WordPress plugin before 4.3.25 does not have CSRF check in place when deleting items, allowing attacker to make a logged in admin delete arbitrary posts via a CSRF attack
Problem types: cwe_id: CWE-352
description: CWE-352 Cross-Site Request Forgery (CSRF)
Affected products: vendor: Unknown
product: NextScripts: Social Networks Auto-Poster
Credits: lang: en
value: Krzysztof Zając
Published: 2022-02-01T12:21:35.000Z
CVE-2021-25073 WP125  < 1.5.5 - Arbitrary Ad Deletion via CSRF
The WP125 WordPress plugin before 1.5.5 does not have CSRF checks in various action, for example when deleting an ad, allowing attackers to make a logged in admin delete them via a CSRF attack
Problem types: cwe_id: CWE-352
description: CWE-352 Cross-Site Request Forgery (CSRF)
Affected products: vendor: Unknown
product: WP125
Credits: lang: en
value: Krzysztof Zając
Published: 2022-01-24T08:01:21.000Z
CVE-2021-25074 WebP Converter for Media < 4.0.3 - Unauthenticated Open redirect
The WebP Converter for Media WordPress plugin before 4.0.3 contains a file (passthru.php) which does not validate the src parameter before redirecting the user to it, leading to an Open Redirect issue
Problem types: cwe_id: CWE-601
description: CWE-601 URL Redirection to Untrusted Site ('Open Redirect')
Affected products: vendor: Unknown
product: WebP Converter for Media – Convert WebP and AVIF & Optimize Images
Credits: lang: en
value: Krzysztof Zając
Published: 2022-01-24T08:01:22.000Z
CVE-2021-25075 Duplicate Page or Post < 1.5.1 - Arbitrary Settings Update to Stored XSS
The Duplicate Page or Post WordPress plugin before 1.5.1 does not have any authorisation and has a flawed CSRF check in the wpdevart_duplicate_post_parametrs_save_in_db AJAX action, allowing any authenticated users, such as subscriber to call it and change the plugin's settings, or perform such attack via CSRF. Furthermore, due to the lack of escaping, this could lead to Stored Cross-Site Scripting issues
Problem types: cwe_id: CWE-862
description: CWE-862 Missing Authorization
Affected products: vendor: Unknown
product: Duplicate Page or Post
Credits: lang: en
value: Krzysztof Zając
Published: 2022-02-21T10:45:50.000Z
CVE-2021-25076 WP User Frontend < 3.5.26 - SQL Injection to Reflected Cross-Site Scripting
The WP User Frontend WordPress plugin before 3.5.26 does not validate and escape the status parameter before using it in a SQL statement in the Subscribers dashboard, leading to an SQL injection. Due to the lack of sanitisation and escaping, this could also lead to Reflected Cross-Site Scripting
Problem types: cwe_id: CWE-89
description: CWE-89 SQL Injection
Affected products: vendor: Unknown
product: WP User Frontend – Membership, Profile, Registration & Post Submission Plugin for WordPress
Credits: lang: en
value: Krzysztof Zając
Published: 2022-01-24T08:01:24.000Z
CVE-2021-25077 Store Toolkit for WooCommerce < 2.3.2 - Reflected Cross-Site Scripting
The Store Toolkit for WooCommerce WordPress plugin before 2.3.2 does not sanitise and escape the tab parameter before outputting it back in an admin page in an error message, leading to a Reflected Cross-Site Scripting
Problem types: cwe_id: CWE-79
description: CWE-79 Cross-site Scripting (XSS)
Affected products: vendor: Unknown
product: Store Toolkit for WooCommerce
Credits: lang: en
value: Krzysztof Zając
Published: 2022-02-07T15:47:17.000Z
CVE-2021-25078 Affiliates Manager < 2.9.0 - Unauthenticated Stored Cross-Site Scripting
The Affiliates Manager WordPress plugin before 2.9.0 does not validate, sanitise and escape the IP address of requests logged by the click tracking feature, allowing unauthenticated attackers to perform Cross-Site Scripting attacks against admin viewing the tracked requests.
Problem types: cwe_id: CWE-79
description: CWE-79 Cross-site Scripting (XSS)
Affected products: vendor: Unknown
product: Affiliates Manager
Credits: lang: en
value: Krzysztof Zając
Published: 2022-01-24T08:01:25.000Z
CVE-2021-25079 Contact Form Entries < 1.2.4 - Reflected Cross-Site Scripting
The Contact Form Entries WordPress plugin before 1.2.4 does not sanitise and escape various parameters, such as form_id, status, end_date, order, orderby and search before outputting them back in the admin page
Problem types: cwe_id: CWE-79
description: CWE-79 Cross-site Scripting (XSS)
Affected products: vendor: Unknown
product: Contact Form Entries – Contact Form 7, WPforms and more
Credits: lang: en
value: Gaetano Perrone
Published: 2022-01-24T08:01:27.000Z
CVE-2021-25080 Contact Form Entries < 1.1.7 - Unauthenticated Stored Cross-Site Scripting
The Contact Form Entries WordPress plugin before 1.1.7 does not validate, sanitise and escape the IP address retrieved via headers such as CLIENT-IP and X-FORWARDED-FOR, allowing unauthenticated attackers to perform Cross-Site Scripting attacks against logged in admins viewing the created entry
Problem types: cwe_id: CWE-79
description: CWE-79 Cross-site Scripting (XSS)
Affected products: vendor: Unknown
product: Contact Form Entries – Contact Form 7, WPforms and more
Credits: lang: en
value: Gaetano Perrone
Published: 2022-01-24T08:01:28.000Z
CVE-2021-25081 WP Google Map < 1.8.4 - Arbitrary Post Deletion and Plugin's Settings Update via CSRF
The Maps Plugin using Google Maps for WordPress plugin before 1.8.4 does not have CSRF checks in most of its AJAX actions, which could allow attackers to make logged in admins delete arbitrary posts and update the plugin's settings via a CSRF attack
Problem types: cwe_id: CWE-352
description: CWE-352 Cross-Site Request Forgery (CSRF)
Affected products: vendor: Unknown
product: Maps Plugin using Google Maps for WordPress – WP Google Map
Credits: lang: en
value: Krzysztof Zając
Published: 2022-02-28T09:06:35.000Z
CVE-2021-25082 Popup Builder < 4.0.7 - LFI to RCE
The Popup Builder WordPress plugin before 4.0.7 does not validate and sanitise the sgpb_type parameter before using it in a require statement, leading to a Local File Inclusion issue. Furthermore, since the beginning of the string can be controlled, the issue can lead to RCE vulnerability via wrappers such as PHAR
Problem types: cwe_id: CWE-22
description: CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Affected products: vendor: Unknown
product: Popup Builder – Create highly converting, mobile friendly marketing popups.
Credits: lang: en
value: JrXnm
Published: 2022-02-21T10:45:51.000Z
CVE-2021-25083 Registrations for the Events Calendar < 2.7.10 - Reflected Cross-Site Scripting
The Registrations for the Events Calendar WordPress plugin before 2.7.10 does not escape the qtype parameter before outputting it back in an attribute in the settings page, leading to a Reflected Cross-Site Scripting
Problem types: cwe_id: CWE-79
description: CWE-79 Cross-site Scripting (XSS)
Affected products: vendor: Unknown
product: Registrations for the Events Calendar – Event Registration Plugin
Credits: lang: en
value: Krzysztof Zając
Published: 2022-01-24T08:01:29.000Z
CVE-2021-25084 Advanced Cron Manager - Subscriber+ Arbitrary Events/Schedules Creation/Deletion
The Advanced Cron Manager WordPress plugin before 2.4.2 and Advanced Cron Manager Pro WordPress plugin before 2.5.3 do not have authorisation checks in some of their AJAX actions, allowing any authenticated users, such as subscriber to call them and add or remove events as well as schedules for example
Problem types: cwe_id: CWE-862
description: CWE-862 Missing Authorization
Affected products: vendor: Unknown
product: Advanced Cron Manager
vendor: Unknown
product: Advanced Cron Manager Pro
Credits: lang: en
value: Krzysztof Zając
Published: 2022-02-07T15:47:18.000Z