rainbutterfly/cve_corpus huggingface dataset:
CVE-2021-24748 Email Before Download < 6.8 - Admin+ SQL Injection
The Email Before Download WordPress plugin before 6.8 does not properly validate and escape the order and orderby GET parameters before using them in SQL statements, leading to authenticated SQL injection issues
Problem types: cwe_id: CWE-89
description: CWE-89 SQL Injection
Affected products: vendor: Unknown
product: Email Before Download
Credits: lang: en
value: bl4derunner
Published: 2021-11-29T08:25:31.000Z
CVE-2021-24749 URL Shortify < 1.5.1 - Arbitrary Link/Group Deletion via CSRF
The URL Shortify WordPress plugin before 1.5.1 does not have CSRF check in place when bulk-deleting links or groups, which could allow attackers to make a logged in admin delete arbitrary link and group via a CSRF attack.
Problem types: cwe_id: CWE-352
description: CWE-352 Cross-Site Request Forgery (CSRF)
Affected products: vendor: Unknown
product: URL Shortify – Simple, Powerful and Easy URL Shortener Plugin For WordPress
Credits: lang: en
value: apple502j
Published: 2021-11-29T08:25:32.000Z
CVE-2021-24750 WP Visitor Statistics (Real Time Traffic) < 4.8 - Subscriber+ SQL Injection
The WP Visitor Statistics (Real Time Traffic) WordPress plugin before 4.8 does not properly sanitise and escape the refUrl in the refDetails AJAX action, available to any authenticated user, which could allow users with a role as low as subscriber to perform SQL injection attacks
Problem types: cwe_id: CWE-89
description: CWE-89 SQL Injection
Affected products: vendor: Unknown
product: WP Visitor Statistics (Real Time Traffic)
Credits: lang: en
value: Krzysztof Zając
Published: 2021-12-21T08:45:29.000Z
CVE-2021-24751 GenerateBlocks < 1.4.0 - Contributor+ Stored Cross-Site Scripting
The GenerateBlocks WordPress plugin before 1.4.0 does not validate the generateblocks/container block's tagName attribute, which could allow users with a role as low as contributor to perform Cross-Site Scripting attacks.
Problem types: cwe_id: CWE-79
description: CWE-79 Cross-site Scripting (XSS)
Affected products: vendor: Unknown
product: GenerateBlocks
Credits: lang: en
value: apple502j
Published: 2021-11-29T08:25:33.000Z
CVE-2021-24752 Multiple Plugins from CatchThemes - Unauthorised Plugin's Setting Change
Multiple Plugins from the CatchThemes vendor do not perform capability and CSRF checks in the ctp_switch AJAX action, which could allow any authenticated users, such as Subscriber to change the Essential Widgets WordPress plugin before 1.9, To Top WordPress plugin before 2.3, Header Enhancement WordPress plugin before 1.5, Generate Child Theme WordPress plugin before 1.6, Essential Content Types WordPress plugin before 1.9, Catch Web Tools WordPress plugin before 2.7, Catch Under Construction WordPress plugin before 1.4, Catch Themes Demo Import WordPress plugin before 1.6, Catch Sticky Menu WordPress plugin before 1.7, Catch Scroll Progress Bar WordPress plugin before 1.6, Social Gallery and Widget WordPress plugin before 2.3, Catch Infinite Scroll WordPress plugin before 1.9, Catch Import Export WordPress plugin before 1.9, Catch Gallery WordPress plugin before 1.7, Catch Duplicate Switcher WordPress plugin before 1.6, Catch Breadcrumb WordPress plugin before 1.7, Catch IDs WordPress plugin before 2.4's configurations.
Problem types: cwe_id: CWE-284
description: CWE-284 Improper Access Control
Affected products: vendor: CatchThemes
product: Essential Widgets
vendor: CatchThemes
product: To Top
vendor: CatchThemes
product: Header Enhancement
vendor: CatchThemes
product: Generate Child Theme
vendor: CatchThemes
product: Essential Content Types
vendor: CatchThemes
product: Catch Web Tools
vendor: CatchThemes
product: Catch Under Construction
vendor: CatchThemes
product: Catch Themes Demo Import
vendor: CatchThemes
product: Catch Sticky Menu
vendor: CatchThemes
product: Catch Scroll Progress Bar
vendor: CatchThemes
product: Social Gallery and Widget
vendor: CatchThemes
product: Catch Infinite Scroll
vendor: CatchThemes
product: Catch Import Export
vendor: CatchThemes
product: Catch Gallery
vendor: CatchThemes
product: Catch Duplicate Switcher
vendor: CatchThemes
product: Catch Breadcrumb
vendor: CatchThemes
product: Catch IDs
Credits: lang: en
value: apple502j
Published: 2021-10-18T13:46:10.000Z
CVE-2021-24753 Rich Reviews by Starfish < 1.9.6 - Admin+ SQL Injection
The Rich Reviews by Starfish WordPress plugin before 1.9.6 does not properly validate the orderby GET parameter of the pending reviews page before using it in a SQL statement, leading to an authenticated SQL injection issue
Problem types: cwe_id: CWE-89
description: CWE-89 SQL Injection
Affected products: vendor: Unknown
product: Rich Reviews by Starfish
Credits: lang: en
value: bl4derunner
Published: 2021-12-27T10:33:18.000Z
CVE-2021-24754 MainWP Child Reports < 2.0.8 - Admin+ SQL Injection
The MainWP Child Reports WordPress plugin before 2.0.8 does not validate or sanitise the order parameter before using it in a SQL statement in the admin dashboard, leading to an SQL injection issue
Problem types: cwe_id: CWE-89
description: CWE-89 SQL Injection
Affected products: vendor: Unknown
product: MainWP Child Reports
Credits: lang: en
value: bl4derunner
Published: 2021-10-18T13:46:12.000Z
CVE-2021-24755 myCred < 2.3 - Subscriber+ SQL Injection
The myCred WordPress plugin before 2.3 does not validate or escape the fields parameter before using it in a SQL statement, leading to an SQL injection exploitable by any authenticated user
Problem types: cwe_id: CWE-89
description: CWE-89 SQL Injection
Affected products: vendor: Unknown
product: myCred – Points, Rewards, Gamification, Ranks, Badges & Loyalty Plugin
Credits: lang: en
value: bl4derunner
Published: 2021-11-29T08:25:35.000Z
CVE-2021-24756 WP System Log < 1.0.21 - Unauthenticated Stored Cross-Site Scripting
The WP System Log WordPress plugin before 1.0.21 does not sanitise, validate and escape the IP address retrieved from login requests before outputting them in the admin dashboard, which could allow unauthenticated attacker to perform Cross-Site Scripting attacks against admins viewing the logs.
Problem types: cwe_id: CWE-79
description: CWE-79 Cross-site Scripting (XSS)
Affected products: vendor: Unknown
product: WP System Log
Credits: lang: en
value: wzy-ceb Attack defense
Published: 2021-12-13T10:40:47.000Z
CVE-2021-24757 Stylish Price List < 6.9.0 - Unauthenticated Arbitrary Image Upload
The Stylish Price List WordPress plugin before 6.9.0 does not perform capability checks in its spl_upload_ser_img AJAX action (available to both unauthenticated and authenticated users), which could allow unauthenticated users to upload images.
Problem types: cwe_id: CWE-863
description: CWE-863 Incorrect Authorization
Affected products: vendor: Unknown
product: Stylish Price List
Credits: lang: en
value: apple502j
Published: 2021-11-01T08:46:17.000Z
CVE-2021-24758 Email Log < 2.4.7 - Admin+ SQL Injection
The Email Log WordPress plugin before 2.4.7 does not properly validate, sanitise and escape the "orderby" and "order" GET parameters before using them in SQL statement in the admin dashboard, leading to SQL injections
Problem types: cwe_id: CWE-89
description: CWE-89 SQL Injection
Affected products: vendor: Unknown
product: Email Log
Credits: lang: en
value: bl4derunner
Published: 2021-11-17T10:15:34.000Z
CVE-2021-24759 PDF.js Viewer < 2.0.2 - Contributor+ Stored Cross-Site Scripting
The PDF.js Viewer WordPress plugin before 2.0.2 does not escape some of its shortcode and Gutenberg Block attributes, which could allow users with a role as low as Contributor to to perform Cross-Site Scripting attacks
Problem types: cwe_id: CWE-79
description: CWE-79 Cross-site Scripting (XSS)
Affected products: vendor: Unknown
product: PDF.js Viewer
Credits: lang: en
value: apple502j
Published: 2021-12-06T15:55:26.000Z
CVE-2021-24760 Gutenberg PDF Viewer Block < 1.0.1 - Contributor+ Stored Cross-Site Scripting
The Gutenberg PDF Viewer Block WordPress plugin before 1.0.1 does not sanitise and escape its block, which could allow users with a role as low as Contributor to perform Cross-Site Scripting attacks.
Problem types: cwe_id: CWE-79
description: CWE-79 Cross-site Scripting (XSS)
Affected products: vendor: Unknown
product: Gutenberg PDF Viewer Block
Credits: lang: en
value: apple502j
Published: 2021-10-18T13:46:13.000Z
CVE-2021-24761 Error Log Viewer < 1.1.2 - Arbitrary Text File Deletion via CSRF
The Error Log Viewer WordPress plugin before 1.1.2 does not perform nonce check when deleting a log file and does not have path traversal prevention, which could allow attackers to make a logged in admin delete arbitrary text files on the web server.
Problem types: cwe_id: CWE-352
description: CWE-352 Cross-Site Request Forgery (CSRF)
cwe_id: CWE-22
description: CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Affected products: vendor: Unknown
product: Error Log Viewer by BestWebSoft
Credits: lang: en
value: apple502j
Published: 2022-02-01T12:21:22.000Z
CVE-2021-24762 Perfect Survey < 1.5.2 - Unauthenticated SQL Injection
The Perfect Survey WordPress plugin before 1.5.2 does not validate and escape the question_id GET parameter before using it in a SQL statement in the get_question AJAX action, allowing unauthenticated users to perform SQL injection.
Problem types: cwe_id: CWE-89
description: CWE-89 SQL Injection
Affected products: vendor: Unknown
product: Perfect Survey
Credits: lang: en
value: apple502j
Published: 2022-02-01T12:21:23.000Z
CVE-2021-24763 Perfect Survey < 1.5.2 - Unauthorised AJAX Call to Stored XSS / Survey Settings Update
The Perfect Survey WordPress plugin before 1.5.2 does not have proper authorisation nor CSRF checks in the save_global_setting AJAX action, allowing unauthenticated users to edit surveys and modify settings. Given the lack of sanitisation and escaping in the settings, this could also lead to a Stored Cross-Site Scripting issue which will be executed in the context of a user viewing any survey
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Credits: lang: en
value: apple502j
Published: 2022-02-01T12:21:23.000Z
CVE-2021-24764 Perfect Survey < 1.5.2 - Reflected Cross-Site Scripting
The Perfect Survey WordPress plugin before 1.5.2 does not sanitise and escape multiple parameters (id and filters[session_id] of single_statistics page, type and message of importexport page) before outputting them back in pages/attributes in the admin dashboard, leading to Reflected Cross-Site Scripting issues
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Credits: lang: en
value: apple502j
Published: 2022-02-01T12:21:24.000Z
CVE-2021-24765 Perfect Survey < 1.5.2 - Unauthenticated Stored Cross-Site Scripting
The Perfect Survey WordPress plugin through 1.5.2 does not validate and escape the X-Forwarded-For header value before outputting it in the statistic page when the Anonymize IP setting of a survey is turned off, leading to a Stored Cross-Site Scripting issue
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Credits: lang: en
value: apple502j
Published: 2022-02-01T12:21:25.000Z
CVE-2021-24766 404 to 301 < 3.0.9 - Logs Deletion via CSRF
The 404 to 301 – Redirect, Log and Notify 404 Errors WordPress plugin before 3.0.9 does not have CSRF check in place when cleaning the logs, which could allow attacker to make a logged in admin delete all of them via a CSRF attack
Problem types: cwe_id: CWE-352
description: CWE-352 Cross-Site Request Forgery (CSRF)
Affected products: vendor: Unknown
product: 404 to 301 – Redirect, Log and Notify 404 Errors
Credits: lang: en
value: apple502j
Published: 2021-11-08T17:35:17.000Z
CVE-2021-24767 Redirect 404 Error Page to Homepage or Custom Page with Logs < 1.7.9 - Log Deletion via CSRF
The Redirect 404 Error Page to Homepage or Custom Page with Logs WordPress plugin before 1.7.9 does not check for CSRF when deleting logs, which could allow attacker to make a logged in admin delete them via a CSRF attack
Problem types: cwe_id: CWE-352
description: CWE-352 Cross-Site Request Forgery (CSRF)
Affected products: vendor: Unknown
product: Redirect 404 Error Page to Homepage or Custom Page with Logs
Credits: lang: en
value: apple502j
Published: 2021-11-08T17:35:18.000Z
CVE-2021-24768 WP RSS Aggregator < 4.19.2 - Admin+ Stored Cross-Site Scripting
The WP RSS Aggregator WordPress plugin before 4.19.2 does not properly sanitise and escape the URL to Blacklist field, allowing malicious HTML to be inserted by high privilege users even when the unfiltered_html capability is disallowed, which could lead to Cross-Site Scripting issues.
Problem types: cwe_id: CWE-79
description: CWE-79 Cross-site Scripting (XSS)
Affected products: vendor: Unknown
product: WP RSS Aggregator – News Feeds, Autoblogging, Youtube Video Feeds and More
Credits: lang: en
value: Huy Nguyen
Published: 2021-11-29T08:25:36.000Z
CVE-2021-24769 Permalink Manager Lite < 2.2.13.1 - Admin+ SQL Injection
The Permalink Manager Lite WordPress plugin before 2.2.13.1 does not validate and escape the orderby parameter before using it in a SQL statement in the Permalink Manager page, leading to a SQL Injection
Problem types: cwe_id: CWE-89
description: CWE-89 SQL Injection
Affected products: vendor: Unknown
product: Permalink Manager Lite
Credits: lang: en
value: bl4derunner
Published: 2021-10-25T13:20:53.000Z
CVE-2021-24770 Stylish Price List < 6.9.1 - Subscriber+ Arbitrary Image Upload
The Stylish Price List WordPress plugin before 6.9.1 does not perform capability checks in its spl_upload_ser_img AJAX action (available to authenticated users), which could allow any authenticated users, such as subscriber, to upload arbitrary images.
Problem types: cwe_id: CWE-863
description: CWE-863 Incorrect Authorization
Affected products: vendor: Unknown
product: Stylish Price List
Credits: lang: en
value: apple502j
Published: 2021-11-01T08:46:18.000Z
CVE-2021-24771 Inspirational Quote Rotator <= 1.0.0 - Admin+ Stored Cross-Site Scripting
The Inspirational Quote Rotator WordPress plugin through 1.0.0 does not sanitize and escape some of its quote fields when adding/editing a quote as admin, leading to Stored Cross-Site scripting issues when the quote is output in the "Quotes list" even when the unfiltered_html capability is disallowed
Problem types: cwe_id: CWE-79
description: CWE-79 Cross-site Scripting (XSS)
Affected products: vendor: Unknown
product: Inspirational Quote Rotator
Credits: lang: en
value: Vishal Mohan
Published: 2021-12-13T10:40:48.000Z
CVE-2021-24772 Stream < 3.8.2 - Admin+ SQL Injection
The Stream WordPress plugin before 3.8.2 does not sanitise and validate the order GET parameter from the Stream Records admin dashboard before using it in a SQL statement, leading to an SQL injection issue.
Problem types: cwe_id: CWE-89
description: CWE-89 SQL Injection
Affected products: vendor: Unknown
product: Stream
Credits: lang: en
value: bl4derunner
Published: 2021-11-17T10:15:35.000Z
CVE-2021-24773 WordPress Download Manager < 3.2.16 - Admin+ Stored Cross-Site Scripting
The WordPress Download Manager WordPress plugin before 3.2.16 does not escape some of the Download settings when outputting them, allowing high privilege users to perform XSS attacks even when the unfiltered_html capability is disallowed
Problem types: cwe_id: CWE-79
description: CWE-79 Cross-site Scripting (XSS)
Affected products: vendor: Unknown
product: WordPress Download Manager
Credits: lang: en
value: Huy Nguyen (Inval1d Team)
Published: 2021-11-01T08:46:20.000Z
CVE-2021-24774 Check & Log Email < 1.0.3 - Admin+ SQL Injections
The Check & Log Email WordPress plugin before 1.0.3 does not validate and escape the "order" and "orderby" GET parameters before using them in a SQL statement when viewing logs, leading to SQL injections issues
Problem types: cwe_id: CWE-89
description: CWE-89 SQL Injection
Affected products: vendor: Unknown
product: Check & Log Email
Credits: lang: en
value: bl4derunner
Published: 2021-10-25T13:20:54.000Z
CVE-2021-24775 Document Embedder < 1.7.5 - Unauthenticated Arbitrary Private/Draft Post Title Disclosure
The Document Embedder WordPress plugin before 1.7.5 contains a REST endpoint, which could allow unauthenticated users to enumerate the title of arbitrary private and draft posts.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Credits: lang: en
value: apple502j
Published: 2022-02-01T12:21:26.000Z
CVE-2021-24776 WP Performance Score Booster < 2.1 - Settings Change via CSRF
The WP Performance Score Booster WordPress plugin before 2.1 does not have CSRF check when saving its settings, which could allow attackers to make a logged in admin change them via a CSRF attack.
Problem types: cwe_id: CWE-352
description: CWE-352 Cross-Site Request Forgery (CSRF)
Affected products: vendor: Unknown
product: WP Performance Score Booster – Optimize Speed, Enable Cache & Page Preload
Credits: lang: en
value: apple502j
Published: 2021-11-17T10:15:37.000Z
CVE-2021-24777 Hotscot Contact Form < 1.3 - Admin+ SQL Injection
The view submission functionality in the Hotscot Contact Form WordPress plugin before 1.3 makes a get request with the sub_id parameter which not sanitised, escaped or validated before inserting to a SQL statement, leading to an SQL injection.
Problem types: cwe_id: CWE-89
description: CWE-89 SQL Injection
Affected products: vendor: Unknown
product: Hotscot Contact Form
Credits: lang: en
value: Syed Sheeraz Ali of Codevigilant
Published: 2022-03-07T08:15:57.000Z
CVE-2021-24778 Tradetracker-Store < 4.6.60 - Admin+ SQL Injection
The test parameter of the xmlfeed in the Tradetracker-Store WordPress plugin before 4.6.60 is not sanitised, escaped or validated before inserting to a SQL statement, leading to SQL injection.
Problem types: cwe_id: CWE-89
description: CWE-89 SQL Injection
Affected products: vendor: Unknown
product: Tradetracker-Store
Credits: lang: en
value: Syed Sheeraz Ali of Codevigilant
Published: 2022-03-07T08:15:58.000Z
CVE-2021-24779 WP Debugging < 2.11.0 - Unauthenticated Plugin's Settings Update
The WP Debugging WordPress plugin before 2.11.0 has its update_settings() function hooked to admin_init and is missing any authorisation and CSRF checks, as a result, the settings can be updated by unauthenticated users.
Problem types: cwe_id: CWE-862
description: CWE-862 Missing Authorization
Affected products: vendor: Unknown
product: WP Debugging
Credits: lang: en
value: apple502j
Published: 2021-10-25T13:20:56.000Z
CVE-2021-24780 Single Post Exporter <= 1.1.1 - Plugin's Settings Update via CSRF
The Single Post Exporter WordPress plugin through 1.1.1 does not have CSRF checks when saving its settings, which could allow attackers to make a logged in admin change them via a CSRF attack and give access to the export feature to any role such as subscriber. Subscriber users would then be able to export an arbitrary post/page (such as private and password protected) via a direct URL
Problem types: cwe_id: CWE-352
description: CWE-352 Cross-Site Request Forgery (CSRF)
Affected products: vendor: Unknown
product: Single Post Exporter
Credits: lang: en
value: Francesco Carlucci
Published: 2021-12-13T10:40:50.000Z
CVE-2021-24781 Image Source Control < 2.3.1 - Contributor+ Arbitrary Post Meta Value Change
The Image Source Control WordPress plugin before 2.3.1 allows users with a role as low as Contributor to change arbitrary post meta fields of arbitrary posts (even those they should not be able to edit)
Problem types: cwe_id: CWE-284
description: CWE-284 Improper Access Control
Affected products: vendor: Unknown
product: Image Source Control
Credits: lang: en
value: apple502j
Published: 2021-11-01T08:46:21.000Z
CVE-2021-24782 Flex Local Fonts <= 1.0.0 - Admin+ Stored Cross-Site-Scripting
The Flex Local Fonts WordPress plugin through 1.0.0 does not escape the Class Name field when adding a font, which could allow hight privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed.
Problem types: cwe_id: CWE-79
description: CWE-79 Cross-site Scripting (XSS)
Affected products: vendor: Unknown
product: Flex Local Fonts
Credits: lang: en
value: Vishal Mohan
Published: 2021-12-13T10:40:51.000Z
CVE-2021-24783 Post Expirator < 2.6.0 - Contributor+ Arbitrary Post Schedule Deletion
The Post Expirator WordPress plugin before 2.6.0 does not have proper capability checks in place, which could allow users with a role as low as Contributor to schedule deletion of arbitrary posts.
Problem types: cwe_id: CWE-863
description: CWE-863 Incorrect Authorization
Affected products: vendor: Unknown
product: Post Expirator: Automatically Unpublish WordPress Posts
Credits: lang: en
value: apple502j
Published: 2021-11-08T17:35:19.000Z
CVE-2021-24784 WP Admin Logo Changer <= 1.0 - Plugin's Settings Update via CSRF
The WP Admin Logo Changer WordPress plugin through 1.0 does not have CSRF check when saving its settings, which could allow attackers to make a logged in admin update them via a CSRF attack.
Problem types: cwe_id: CWE-352
description: CWE-352 Cross-Site Request Forgery (CSRF)
Affected products: vendor: Unknown
product: WP Admin Logo Changer
Credits: lang: en
value: apple502j
Published: 2021-12-13T10:40:52.000Z
CVE-2021-24785 Great Quotes <= 1.0.0 - Admin+ Stored Cross-Site Scripting
The Great Quotes WordPress plugin through 1.0.0 does not sanitise and escape the Quote and Author fields of its Quotes, which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html is disallowed.
Problem types: cwe_id: CWE-79
description: CWE-79 Cross-site Scripting (XSS)
Affected products: vendor: Unknown
product: Great Quotes
Credits: lang: en
value: Vishal Mohan
Published: 2021-10-25T13:20:57.000Z
CVE-2021-24786 Download Monitor < 4.4.5 - Admin+ SQL Injection
The Download Monitor WordPress plugin before 4.4.5 does not properly validate and escape the "orderby" GET parameter before using it in a SQL statement when viewing the logs, leading to an SQL Injection issue
Problem types: cwe_id: CWE-89
description: CWE-89 SQL Injection
Affected products: vendor: Unknown
product: Download Monitor
Credits: lang: en
value: bl4derunner
Published: 2022-01-03T12:49:03.000Z
CVE-2021-24787 Client Invoicing by Sprout Invoices < 19.9.7 - Admin+ Stored Cross-Site Scripting
The Client Invoicing by Sprout Invoices WordPress plugin before 19.9.7 does not sanitise and escape some of its settings, which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed
Problem types: cwe_id: CWE-79
description: CWE-79 Cross-site Scripting (XSS)
Affected products: vendor: Unknown
product: Client Invoicing by Sprout Invoices – Easy Estimates and Invoices for WordPress
Credits: lang: en
value: Dipak Panchal
Published: 2021-11-17T10:15:38.000Z
CVE-2021-24788 Batch Cat <= 0.3 - Subscriber+ Arbitrary Categories Add/Set/Delete to Posts
The Batch Cat WordPress plugin through 0.3 defines 3 custom AJAX actions, which both require authentication but are available for all roles. As a result, any authenticated user (including simple subscribers) can add/set/delete arbitrary categories to posts.
Problem types: cwe_id: CWE-863
description: CWE-863 Incorrect Authorization
Affected products: vendor: Unknown
product: Batch Cat
Credits: lang: en
value: Quentin VILLAIN (3wsec)
Published: 2021-11-08T17:35:20.000Z
CVE-2021-24789 Flat Preloader < 1.5.5 - Admin+ Stored Cross-Site Scripting
The Flat Preloader WordPress plugin before 1.5.5 does not escape some of its settings when outputting them in attribute in the frontend, which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html is disallowed
Problem types: cwe_id: CWE-79
description: CWE-79 Cross-site Scripting (XSS)
Affected products: vendor: Unknown
product: Flat Preloader
Credits: lang: en
value: apple502j
Published: 2021-11-01T08:46:23.000Z