rainbutterfly/cve_corpus huggingface dataset:
CVE-2021-24333 Content Copy Protection & Prevent Image Save <= 1.3 - CSRF to Stored Cross-Site Scripting (XSS)
The Content Copy Protection & Prevent Image Save WordPress plugin through 1.3 does not check for CSRF when saving its settings, not perform any validation and sanitisation on them, allowing attackers to make a logged in administrator set arbitrary XSS payloads in them.
Problem types: cwe_id: CWE-352
description: CWE-352 Cross-Site Request Forgery (CSRF)
Affected products: vendor: Unknown
product: Content Copy Protection & Prevent Image Save
Credits: lang: en
value: m0ze
Published: 2021-06-01T11:33:31.000Z
CVE-2021-24334 Instant Images WordPress Plugin < 4.4.0.1 - Authenticated Stored XSS & XFS
The Instant Images – One Click Unsplash Uploads WordPress plugin before 4.4.0.1 did not properly validate and sanitise its unsplash_download_w and unsplash_download_h parameter settings (/wp-admin/upload.php?page=instant-images), only validating them client side before saving them, leading to a Stored Cross-Site Scripting issue.
Problem types: cwe_id: CWE-79
description: CWE-79 Cross-site Scripting (XSS)
Affected products: vendor: Unknown
product: Instant Images – One Click Unsplash Uploads
Credits: lang: en
value: m0ze
Published: 2021-06-01T11:33:31.000Z
CVE-2021-24335 Car Repair Services < 4.0 - Unauthenticated Reflected XSS & XFS
The Car Repair Services & Auto Mechanic WordPress theme before 4.0 did not properly sanitise its serviceestimatekey search parameter before outputting it back in the page, leading to a reflected Cross-Site Scripting issue
Problem types: cwe_id: CWE-79
description: CWE-79 Cross-site Scripting (XSS)
Affected products: vendor: Unknown
product: Car Repair Services & Auto Mechanic
Credits: lang: en
value: m0ze
Published: 2021-06-01T11:33:31.000Z
CVE-2021-24336 FlightLog <= 3.0.2 - Authenticated (editor+) SQL Injection
The FlightLog WordPress plugin through 3.0.2 does not sanitise, validate or escape various POST parameters before using them a SQL statement, leading to SQL injections exploitable by editor and administrator users
Problem types: cwe_id: CWE-89
description: CWE-89 SQL Injection
Affected products: vendor: Unknown
product: FlightLog
Credits: lang: en
value: Shreya Pohekar of Codevigilant Project
Published: 2021-06-07T10:49:49.000Z
CVE-2021-24337 Video Embed <= 1.0 - Authenticated (subscriber+) SQL Injection
The id GET parameter of one of the Video Embed WordPress plugin through 1.0's page (available via forced browsing) is not sanitised, validated or escaped before being used in a SQL statement, allowing low privilege users, such as subscribers, to perform SQL injection.
Problem types: cwe_id: CWE-89
description: CWE-89 SQL Injection
Affected products: vendor: Unknown
product: Video Embed
Credits: lang: en
value: Syed Sheeraz Ali of Code Vigilant Project
Published: 2021-06-07T10:49:50.000Z
CVE-2021-24338 Pods < 2.7.27 - Authenticated Stored Cross-Site Scripting (XSS)
The Pods – Custom Content Types and Fields WordPress plugin before 2.7.27 was vulnerable to an Authenticated Stored Cross-Site Scripting (XSS) security vulnerability within the 'Singular Label' field parameter.
Problem types: cwe_id: CWE-79
description: CWE-79 Cross-site Scripting (XSS)
Affected products: vendor: Pods Framework Team
product: Pods – Custom Content Types and Fields
Credits: lang: en
value: WhiteSource
Published: 2021-06-21T19:18:12.000Z
CVE-2021-24339 Pods < 2.7.27 - Authenticated Stored Cross-Site Scripting (XSS)
The Pods – Custom Content Types and Fields WordPress plugin before 2.7.27 was vulnerable to an Authenticated Stored Cross-Site Scripting (XSS) security vulnerability within the 'Menu Label' field parameter.
Problem types: cwe_id: CWE-79
description: CWE-79 Cross-site Scripting (XSS)
Affected products: vendor: Pods Framework Team
product: Pods – Custom Content Types and Fields
Credits: lang: en
value: WhiteSource
Published: 2021-06-21T19:18:13.000Z
CVE-2021-24340 WP Statistics < 13.0.8 - Unauthenticated SQL Injection
The WP Statistics WordPress plugin before 13.0.8 relied on using the WordPress esc_sql() function on a field not delimited by quotes and did not first prepare the query. Additionally, the page, which should have been accessible to administrator only, was also available to any visitor, including unauthenticated ones.
Problem types: cwe_id: CWE-89
description: CWE-89 SQL Injection
Affected products: vendor: VeronaLabs
product: WP Statistics
Credits: lang: en
value: Ram Gall (Wordfence)
Published: 2021-06-07T10:49:50.000Z
CVE-2021-24341 Xllentech English Islamic Calendar < 2.6.8 - Authenticated SQL Injection
When deleting a date in the Xllentech English Islamic Calendar WordPress plugin before 2.6.8, the year_number and month_number POST parameters are not sanitised, escaped or validated before being used in a SQL statement, leading to SQL injection.
Problem types: cwe_id: CWE-89
description: CWE-89 SQL Injection
Affected products: vendor: Unknown
product: Xllentech English Islamic Calendar
Credits: lang: en
value: Syed Sheeraz Ali of Codevigilant
Published: 2021-06-14T13:37:12.000Z
CVE-2021-24342 JNews < 8.0.6 - Reflected Cross-Site Scripting (XSS)
The JNews WordPress theme before 8.0.6 did not sanitise the cat_id parameter in the POST request /?ajax-request=jnews (with action=jnews_build_mega_category_*), leading to a Reflected Cross-Site Scripting (XSS) issue.
Problem types: cwe_id: CWE-79
description: CWE-79 Cross-site Scripting (XSS)
Affected products: vendor: Unknown
product: JNews
Credits: lang: en
value: Truoc Phan from Techlab Corporation
Published: 2021-06-07T10:49:50.000Z
CVE-2021-24343 iFlyChat – WordPress Chat < 4.7.0 - Admin+ Stored Cross-Site Scripting (XSS)
The iFlyChat WordPress plugin before 4.7.0 does not sanitise its APP ID setting before outputting it back in the page, leading to an authenticated Stored Cross-Site Scripting issue
Problem types: cwe_id: CWE-79
description: CWE-79 Cross-site Scripting (XSS)
Affected products: vendor: Unknown
product: iFlyChat – WordPress Chat
Credits: lang: en
value: Kishore Hariram
Published: 2021-06-07T10:49:50.000Z
CVE-2021-24344 Easy Preloader <= 1.0.0 - Authenticated Stored Cross-Site Scripting (XSS)
The Easy Preloader WordPress plugin through 1.0.0 does not sanitise its setting fields, leading to authenticated (admin+) Stored Cross-Site scripting issues
Problem types: cwe_id: CWE-79
description: CWE-79 Cross-site Scripting (XSS)
Affected products: vendor: Unknown
product: Easy Preloader
Credits: lang: en
value: Kishore Hariram
Published: 2021-06-07T10:49:50.000Z
CVE-2021-24345 Sendit WP Newsletter <= 2.5.1 - Authenticated (admin+) SQL Injection
The page lists-management feature of the Sendit WP Newsletter WordPress plugin through 2.5.1, available to Administrator users does not sanitise, validate or escape the id_lista POST parameter before using it in SQL statement, therefore leading to Blind SQL Injection.
Problem types: cwe_id: CWE-89
description: CWE-89 SQL Injection
Affected products: vendor: Unknown
product: Sendit WP Newsletter
Credits: lang: en
value: Shreya Pohekar of Codevigilant Project
Published: 2021-06-14T13:37:12.000Z
CVE-2021-24346 Stock in & out <= 1.0.4 - Reflected Cross-Site Scripting (XSS)
The Stock in & out WordPress plugin through 1.0.4 has a search functionality, the lowest accessible level to it being contributor. The srch POST parameter is not validated, sanitised or escaped before using it in the echo statement, leading to a reflected XSS issue
Problem types: cwe_id: CWE-79
description: CWE-79 Cross-site Scripting (XSS)
Affected products: vendor: Unknown
product: Stock in & out
Credits: lang: en
value: Shreya Pohekar of Codevigilant Project
Published: 2021-06-14T13:37:12.000Z
CVE-2021-24347 SP Project & Document Manager <2 4.22 - Authenticated Shell Upload
The SP Project & Document Manager WordPress plugin before 4.22 allows users to upload files, however, the plugin attempts to prevent php and other similar files that could be executed on the server from being uploaded by checking the file extension. It was discovered that php files could still be uploaded by changing the file extension's case, for example, from "php" to "pHP".
Problem types: cwe_id: CWE-178
description: CWE-178 Improper Handling of Case Sensitivity
Affected products: vendor: Unknown
product: SP Project & Document Manager
Credits: lang: en
value: Viktor Markopoulos
Published: 2021-06-14T13:37:12.000Z
CVE-2021-24348 Side Menu < 3.1.5 - Authenticated (admin+) SQL Injection
The menu delete functionality of the Side Menu – add fixed side buttons WordPress plugin before 3.1.5, available to Administrator users takes the did GET parameter and uses it into an SQL statement without proper sanitisation, validation or escaping, therefore leading to a SQL Injection issue
Problem types: cwe_id: CWE-89
description: CWE-89 SQL Injection
Affected products: vendor: Unknown
product: Side Menu – add fixed side buttons
Credits: lang: en
value: Shreya Pohekar of Codevigilant Project
Published: 2021-06-14T13:37:12.000Z
CVE-2021-24349 Gallery From Files <= 1.6.0 - Reflected Cross-Site Scripting (XSS)
This Gallery from files WordPress plugin through 1.6.0 gives the functionality of uploading images to the server. But filenames are not properly sanitized before being output in an error message when they have an invalid extension, leading to a reflected Cross-Site Scripting issue. Due to the lack of CSRF check, the attack could also be performed via such vector.
Problem types: cwe_id: CWE-79
description: CWE-79 Cross-site Scripting (XSS)
cwe_id: CWE-352
description: CWE-352 Cross-Site Request Forgery (CSRF)
Affected products: vendor: Unknown
product: Gallery from files
Credits: lang: en
value: Satyender Yadav
Published: 2021-06-14T13:37:13.000Z
CVE-2021-24350 Visitors <= 0.3 - Unauthenticated Stored Cross-Site Scripting (XSS)
The Visitors WordPress plugin through 0.3 is affected by an Unauthenticated Stored Cross-Site Scripting (XSS) vulnerability. The plugin would display the user's user agent string without validation or encoding within the WordPress admin panel.
Problem types: cwe_id: CWE-79
description: CWE-79 Cross-site Scripting (XSS)
Affected products: vendor: Unknown
product: Visitors
Credits: lang: en
value: Mesut Cetin
Published: 2021-06-14T13:37:13.000Z
CVE-2021-24351 The Plus Addons for Elementor < 4.1.12 - Reflected Cross-Site Scripting (XSS)
The theplus_more_post AJAX action of The Plus Addons for Elementor Page Builder WordPress plugin before 4.1.12 did not properly sanitise some of its fields, leading to a reflected Cross-Site Scripting (exploitable on both unauthenticated and authenticated users)
Problem types: cwe_id: CWE-79
description: CWE-79 Cross-site Scripting (XSS)
Affected products: vendor: Unknown
product: The Plus Addons for Elementor Page Builder
Credits: lang: en
value: Nicolas Verdier from TEHTRIS
Published: 2021-06-14T13:37:13.000Z
CVE-2021-24352 Simple 301 Redirects by BetterLinks - 2.0.0 – 2.0.3 - Unauthenticated Redirect Export
The export_data function of the Simple 301 Redirects by BetterLinks WordPress plugin before 2.0.4 had no capability or nonce checks making it possible for unauthenticated users to export a site's redirects.
Problem types: cwe_id: CWE-862
description: CWE-862 Missing Authorization
Affected products: vendor: Unknown
product: Simple 301 Redirects by BetterLinks
Credits: lang: en
value: Chloe Chamberland
Published: 2021-06-14T13:37:13.000Z
CVE-2021-24353 Simple 301 Redirects by BetterLinks - 2.0.0 – 2.0.3 - Unauthenticated Redirect Import
The import_data function of the Simple 301 Redirects by BetterLinks WordPress plugin before 2.0.4 had no capability or nonce checks making it possible for unauthenticated users to import a set of site redirects.
Problem types: cwe_id: CWE-862
description: CWE-862 Missing Authorization
Affected products: vendor: Unknown
product: Simple 301 Redirects by BetterLinks
Credits: lang: en
value: Chloe Chamberland
Published: 2021-06-14T13:37:13.000Z
CVE-2021-24354 Simple 301 Redirects by BetterLinks - 2.0.0-2.0.3 - Arbitrary Plugin Installation
A lack of capability checks and insufficient nonce check on the AJAX action in the Simple 301 Redirects by BetterLinks WordPress plugin before 2.0.4, made it possible for authenticated users to install arbitrary plugins on vulnerable sites.
Problem types: cwe_id: CWE-862
description: CWE-862 Missing Authorization
Affected products: vendor: Unknown
product: Simple 301 Redirects by BetterLinks
Credits: lang: en
value: Chloe Chamberland
Published: 2021-06-14T13:37:13.000Z
CVE-2021-24355 Simple 301 Redirects by BetterLinks - 2.0.0 – 2.0.3 - Update and Retrieve Wildcard Value
In the Simple 301 Redirects by BetterLinks WordPress plugin before 2.0.4, the lack of capability checks and insufficient nonce check on the AJAX actions, simple301redirects/admin/get_wildcard and simple301redirects/admin/wildcard, made it possible for authenticated users to retrieve and update the wildcard value for redirects.
Problem types: cwe_id: CWE-862
description: CWE-862 Missing Authorization
Affected products: vendor: Unknown
product: Simple 301 Redirects by BetterLinks
Credits: lang: en
value: Chloe Chamberland
Published: 2021-06-14T13:37:13.000Z
CVE-2021-24356 Simple 301 Redirects by BetterLinks - 2.0.0 – 2.0.3 - Arbitrary Plugin Activation
In the Simple 301 Redirects by BetterLinks WordPress plugin before 2.0.4, a lack of capability checks and insufficient nonce check on the AJAX action, simple301redirects/admin/activate_plugin, made it possible for authenticated users to activate arbitrary plugins installed on vulnerable sites.
Problem types: cwe_id: CWE-862
description: CWE-862 Missing Authorization
Affected products: vendor: Unknown
product: Simple 301 Redirects by BetterLinks
Credits: lang: en
value: Chloe Chamberland
Published: 2021-06-14T13:37:13.000Z
CVE-2021-24357 FooGallery < 2.0.35 - Authenticated Stored Cross-Site Scripting
In the Best Image Gallery & Responsive Photo Gallery – FooGallery WordPress plugin before 2.0.35, the Custom CSS field of each gallery is not properly sanitised or validated before being being output in the page where the gallery is embed, leading to a stored Cross-Site Scripting issue.
Problem types: cwe_id: CWE-79
description: CWE-79 Cross-site Scripting (XSS)
Affected products: vendor: FooPlugins
product: Best Image Gallery & Responsive Photo Gallery – FooGallery
Credits: lang: en
value: avolume
Published: 2021-06-14T13:37:14.000Z
CVE-2021-24358 The Plus Addons for Elementor Page Builder < 4.1.10 - Open Redirect
The Plus Addons for Elementor Page Builder WordPress plugin before 4.1.10 did not validate a redirect parameter on a specifically crafted URL before redirecting the user to it, leading to an Open Redirect issue.
Problem types: cwe_id: CWE-601
description: CWE-601 URL Redirection to Untrusted Site ('Open Redirect')
Affected products: vendor: Unknown
product: The Plus Addons for Elementor Page Builder
Credits: lang: en
value: Nicolas Vidal from TEHTRIS
Published: 2021-06-14T13:37:14.000Z
CVE-2021-24359 The Plus Addons for Elementor Page Builder < 4.1.11 - Arbitrary Reset Pwd Email Sending
The Plus Addons for Elementor Page Builder WordPress plugin before 4.1.11 did not properly check that a user requesting a password reset was the legitimate user, allowing an attacker to send an arbitrary reset password email to a registered user on behalf of the WordPress site. Such issue could be chained with an open redirect (CVE-2021-24358) in version below 4.1.10, to include a crafted password reset link in the email, which would lead to an account takeover.
Problem types: cwe_id: CWE-284
description: CWE-284 Improper Access Control
Affected products: vendor: Unknown
product: The Plus Addons for Elementor Page Builder
Credits: lang: en
value: Nicolas Vidal from TEHTRIS
Published: 2021-06-14T13:37:14.000Z
CVE-2021-24360 Yes/No Chart < 1.0.12 - Authenticated (contributor+) Blind SQL Injection
The Yes/No Chart WordPress plugin before 1.0.12 did not sanitise its sid shortcode parameter before using it in a SQL statement, allowing medium privilege users (contributor+) to perform Blind SQL Injection attacks
Problem types: cwe_id: CWE-89
description: CWE-89 SQL Injection
Affected products: vendor: Unknown
product: Yes/No Chart
Credits: lang: en
value: apple502j
Published: 2021-06-14T13:37:14.000Z
CVE-2021-24361 GeoDirectory Location Manager < 2.1.0.10 - Multiple Unauthenticated SQL Injections
In the Location Manager WordPress plugin before 2.1.0.10, the AJAX action gd_popular_location_list did not properly sanitise or validate some of its POST parameters, which are then used in a SQL statement, leading to unauthenticated SQL Injection issues.
Problem types: cwe_id: CWE-89
description: CWE-89 SQL Injection
Affected products: vendor: AyeCode Ltd
product: Location Manager
Credits: lang: en
value: Rafal Goryl
Published: 2021-06-21T19:18:14.000Z
CVE-2021-24362 Photo Gallery < 1.5.75 - Stored Cross-Site Scripting via Uploaded SVG
The Photo Gallery by 10Web – Mobile-Friendly Image Gallery WordPress plugin before 1.5.75 did not ensure that uploaded SVG files added to a gallery do not contain malicious content. As a result, users allowed to add images to gallery can upload an SVG file containing JavaScript code, which will be executed when accessing the image directly (ie in the /wp-content/uploads/photo-gallery/ folder), leading to a Cross-Site Scripting (XSS) issue
Problem types: cwe_id: CWE-79
description: CWE-79 Cross-site Scripting (XSS)
Affected products: vendor: Unknown
product: Photo Gallery by 10Web – Mobile-Friendly Image Gallery
Credits: lang: en
value: avolume
Published: 2021-08-16T10:48:16.000Z
CVE-2021-24363 Photo Gallery < 1.5.75 - File Upload Path Traversal
The Photo Gallery by 10Web – Mobile-Friendly Image Gallery WordPress plugin before 1.5.75 did not ensure that uploaded files are kept inside its uploads folder, allowing high privilege users to put images/SVG anywhere in the filesystem via a path traversal vector
Problem types: cwe_id: CWE-22
description: CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Affected products: vendor: Unknown
product: Photo Gallery by 10Web – Mobile-Friendly Image Gallery
Credits: lang: en
value: avolume
Published: 2021-08-16T10:48:17.000Z
CVE-2021-24364 Jannah < 5.4.4 - Reflected Cross-Site Scripting (XSS)
The Jannah WordPress theme before 5.4.4 did not properly sanitize the options JSON parameter in its tie_get_user_weather AJAX action before outputting it back in the page, leading to a Reflected Cross-Site Scripting (XSS) vulnerability.
Problem types: cwe_id: CWE-79
description: CWE-79 Cross-site Scripting (XSS)
Affected products: vendor: TieLabs
product: Jannah
Credits: lang: en
value: Truoc Phan - Techlab Corporation
Published: 2021-06-21T19:18:15.000Z
CVE-2021-24365 Admin Columns Free (< 4.3.2) & Pro (< 5.5.2) - Authenticated Stored Cross-Site Scripting (XSS) in Custom Field
The Admin Columns WordPress plugin Free before 4.3.2 and Pro before 5.5.2 allowed to configure individual columns for tables. Each column had a type. The type "Custom Field" allowed to choose an arbitrary database column to display in the table. There was no escaping applied to the contents of "Custom Field" columns.
Problem types: cwe_id: CWE-79
description: CWE-79 Cross-site Scripting (XSS)
Affected products: vendor: AdminColumns
product: Admin Columns
vendor: AdminColumns
product: Admin Columns Pro
Credits: lang: en
value: Johannes Lauinger
lang: en
value: SySS GmbH
Published: 2021-07-12T19:20:49.000Z
CVE-2021-24366 Admin Columns Free < 4.3 & Pro < 5.5.1 - Admin+ Stored XSS in Label
The Admin Columns WordPress plugin before 4.3 and Admin Columns Pro WordPress plugin before 5.5.1 do not sanitise and escape its Label settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
Problem types: description: CWE-79 Cross-Site Scripting (XSS)
Affected products: vendor: Unknown
product: Admin Columns
default_status: unaffected
vendor: Unknown
product: Admin Columns Pro
default_status: unaffected
Credits: lang: en
value: Daniel Elkabes of WhiteSource
lang: en
value: WPScan
Published: 2021-06-21T19:18:16.000Z
CVE-2021-24367 WP Config File Editor <= 1.7.1 - Authenticated Stored Cross-Site Scripting (XSS)
The WP Config File Editor WordPress plugin through 1.7.1 was affected by an Authenticated Stored Cross-Site Scripting (XSS) vulnerability.
Problem types: cwe_id: CWE-79
description: CWE-79 Cross-site Scripting (XSS)
Affected products: vendor: Unknown
product: WP Config File Editor
Credits: lang: en
value: blackangel
Published: 2021-06-21T19:18:17.000Z
CVE-2021-24368 Quiz And Survey Master < 7.1.18 - Reflected Cross-Site Scripting (XSS)
The Quiz And Survey Master – Best Quiz, Exam and Survey Plugin WordPress plugin before 7.1.18 did not sanitise or escape its result_id parameter when displaying an existing quiz result page, leading to a reflected Cross-Site Scripting issue. This could allow for privilege escalation by inducing a logged in admin to open a malicious link
Problem types: cwe_id: CWE-79
description: CWE-79 Cross-site Scripting (XSS)
Affected products: vendor: ExpressTech
product: Quiz And Survey Master – Best Quiz, Exam and Survey Plugin for WordPress
Credits: lang: en
value: renniepak
Published: 2021-06-20T12:31:32.000Z
CVE-2021-24369 GetPaid < 2.3.4 - Authenticated Stored XSS
In the GetPaid WordPress plugin before 2.3.4, users with the contributor role and above can create a new Payment Form, however the Label and Help Text input fields were not getting sanitized properly. So it was possible to inject malicious content such as img tags, leading to a Stored Cross-Site Scripting issue which is triggered when the form will be edited, for example when an admin reviews it and could lead to privilege escalation.
Problem types: cwe_id: CWE-79
description: CWE-79 Cross-site Scripting (XSS)
Affected products: vendor: AyeCode Ltd
product: WordPress Payments Plugin | GetPaid
Credits: lang: en
value: Jörg Steinsträter
Published: 2021-06-21T19:18:18.000Z
CVE-2021-24370 Fancy Product Designer < 4.6.9 - Unauthenticated Arbitrary File Upload and RCE
The Fancy Product Designer WordPress plugin before 4.6.9 allows unauthenticated attackers to upload arbitrary files, resulting in remote code execution.
Problem types: cwe_id: CWE-434
description: CWE-434 Unrestricted Upload of File with Dangerous Type
Affected products: vendor: Unknown
product: Fancy Product Designer
Credits: lang: en
value: Charles Sweethill/Ram Gall
Published: 2021-06-21T00:00:00.000Z
CVE-2021-24371 RSVPMaker < 8.7.3 - Authenticated (admin+) SSRF
The Import feature of the RSVPMaker WordPress plugin before 8.7.3 (/wp-admin/tools.php?page=rsvpmaker_export_screen) takes an URL input and calls curl on it, without first validating it to ensure it's a remote one. As a result, a high privilege user could use that feature to scan the internal network via a SSRF attack.
Problem types: cwe_id: CWE-918
description: CWE-918 Server-Side Request Forgery (SSRF)
Affected products: vendor: Unknown
product: RSVPMaker
Credits: lang: en
value: Shreya Pohekar of Codevigilant Project
Published: 2021-08-02T10:31:53.000Z
CVE-2021-24372 WP Hardening < 1.2.2 - Reflected XSS via URI
The WP Hardening – Fix Your WordPress Security WordPress plugin before 1.2.2 did not sanitise or escape the $_SERVER['REQUEST_URI'] before outputting it in an attribute, leading to a reflected Cross-Site Scripting issue.
Problem types: cwe_id: CWE-79
description: CWE-79 Cross-site Scripting (XSS)
Affected products: vendor: Unknown
product: WP Hardening – Fix Your WordPress Security
Credits: lang: en
value: dc11
Published: 2021-06-21T19:18:19.000Z
CVE-2021-24373 WP Hardening < 1.2.2 - Reflected XSS via historyvalue
The WP Hardening – Fix Your WordPress Security WordPress plugin before 1.2.2 did not sanitise or escape the historyvalue GET parameter before outputting it in a Javascript block, leading to a reflected Cross-Site Scripting issue.
Problem types: cwe_id: CWE-79
description: CWE-79 Cross-site Scripting (XSS)
Affected products: vendor: Unknown
product: WP Hardening – Fix Your WordPress Security
Credits: lang: en
value: dc11
Published: 2021-06-21T19:18:20.000Z