rainbutterfly/cve_corpus huggingface dataset:
CVE-2021-24186 Tutor LMS < 1.8.3 - SQL Injection via tutor_answering_quiz_question/get_answer_by_id
The tutor_answering_quiz_question/get_answer_by_id function pair from the Tutor LMS – eLearning and online course solution WordPress plugin before 1.8.3 was vulnerable to UNION based SQL injection that could be exploited by students.
Problem types: cwe_id: CWE-89
description: CWE-89 SQL Injection
Affected products: vendor: Unknown
product: Tutor LMS – eLearning and online course solution
Credits: lang: en
value: Chloe Chamberland
Published: 2021-04-05T18:27:45.000Z
CVE-2021-24187 SEO Redirection < 6.4 - Authenticated Reflected Cross-Site Scripting (XSS)
The setting page of the SEO Redirection Plugin - 301 Redirect Manager WordPress plugin before 6.4 is vulnerable to reflected Cross-Site Scripting (XSS) as user input is not properly sanitised before being output in an attribute.
Problem types: cwe_id: CWE-79
description: CWE-79 Cross-site Scripting (XSS)
Affected products: vendor: Unknown
product: SEO Redirection Plugin - 301 Redirect Manager
Credits: lang: en
value: Nguyen Anh Tien - SunCSR (Sun* Cyber Security Research)
Published: 2021-04-05T18:27:45.000Z
CVE-2021-24188 WP Content Copy Protection & No Right Click < 3.1.5 - Arbitrary Plugin Installation/Activation via Low Privilege User
Low privileged users can use the AJAX action 'cp_plugins_do_button_job_later_callback' in the WP Content Copy Protection & No Right Click WordPress plugin before 3.1.5, to install any plugin (including a specific version) from the WordPress repository, as well as activate arbitrary plugin from then blog, which helps attackers install vulnerable plugins and could lead to more critical vulnerabilities like RCE.
Problem types: cwe_id: CWE-285
description: CWE-285 Improper Authorization
Affected products: vendor: wp-buy
product: WP Content Copy Protection & No Right Click
Credits: lang: en
value: Bugbang
Published: 2021-05-14T11:38:15.000Z
CVE-2021-24189 Captchinoo, Google recaptcha for admin login page < 2.4 - Arbitrary Plugin Installation/Activation via Low Privilege User
Low privileged users can use the AJAX action 'cp_plugins_do_button_job_later_callback' in the Captchinoo, Google recaptcha for admin login page WordPress plugin before 2.4, to install any plugin (including a specific version) from the WordPress repository, as well as activate arbitrary plugin from then blog, which helps attackers install vulnerable plugins and could lead to more critical vulnerabilities like RCE.
Problem types: cwe_id: CWE-285
description: CWE-285 Improper Authorization
Affected products: vendor: wp-buy
product: Captchinoo, Google recaptcha for admin login page
Credits: lang: en
value: Bugbang
Published: 2021-05-14T11:38:16.000Z
CVE-2021-24190 WooCommerce Conditional Marketing Mailer < 1.5.2 - Arbitrary Plugin Installation/Activation via Low Privilege User
Low privileged users can use the AJAX action 'cp_plugins_do_button_job_later_callback' in the WooCommerce Conditional Marketing Mailer WordPress plugin before 1.5.2, to install any plugin (including a specific version) from the WordPress repository, as well as activate arbitrary plugin from then blog, which helps attackers install vulnerable plugins and could lead to more critical vulnerabilities like RCE.
Problem types: cwe_id: CWE-285
description: CWE-285 Improper Authorization
Affected products: vendor: wp-buy
product: WooCommerce Conditional Marketing Mailer
Credits: lang: en
value: Bugbang
Published: 2021-05-14T11:38:16.000Z
CVE-2021-24191 WP Maintenance Mode & Site Under Construction < 1.8.2 - Arbitrary Plugin Installation/Activation via Low Privilege User
Low privileged users can use the AJAX action 'cp_plugins_do_button_job_later_callback' in the WP Maintenance Mode & Site Under Construction WordPress plugin before 1.8.2, to install any plugin (including a specific version) from the WordPress repository, as well as activate arbitrary plugin from then blog, which helps attackers install vulnerable plugins and could lead to more critical vulnerabilities like RCE.
Problem types: cwe_id: CWE-285
description: CWE-285 Improper Authorization
Affected products: vendor: wp-buy
product: WP Maintenance Mode & Site Under Construction
Credits: lang: en
value: Bugbang
Published: 2021-05-14T11:38:16.000Z
CVE-2021-24192 Tree Sitemap < 2.9 - Arbitrary Plugin Installation/Activation via Low Privilege User
Low privileged users can use the AJAX action 'cp_plugins_do_button_job_later_callback' in the Tree Sitemap WordPress plugin before 2.9, to install any plugin (including a specific version) from the WordPress repository, as well as activate arbitrary plugin from then blog, which helps attackers install vulnerable plugins and could lead to more critical vulnerabilities like RCE.
Problem types: cwe_id: CWE-285
description: CWE-285 Improper Authorization
Affected products: vendor: wp-buy
product: Tree Sitemap (Pages, Posts & Categories list)
Credits: lang: en
value: Bugbang
Published: 2021-05-14T11:38:16.000Z
CVE-2021-24193 Visitor Traffic Real Time Statistics < 2.12 - Arbitrary Plugin Installation/Activation via Low Privilege User
Low privileged users can use the AJAX action 'cp_plugins_do_button_job_later_callback' in the Visitor Traffic Real Time Statistics WordPress plugin before 2.12, to install any plugin (including a specific version) from the WordPress repository, as well as activate arbitrary plugin from then blog, which helps attackers install vulnerable plugins and could lead to more critical vulnerabilities like RCE.
Problem types: cwe_id: CWE-285
description: CWE-285 Improper Authorization
Affected products: vendor: wp-buy
product: Visitor Traffic Real Time Statistics
Credits: lang: en
value: Bugbang
Published: 2021-05-14T11:38:16.000Z
CVE-2021-24194 Login Protection - Limit Failed Login Attempts < 2.9 - Arbitrary Plugin Installation/Activation via Low Privilege User
Low privileged users can use the AJAX action 'cp_plugins_do_button_job_later_callback' in the Login Protection - Limit Failed Login Attempts WordPress plugin before 2.9, to install any plugin (including a specific version) from the WordPress repository, as well as activate arbitrary plugin from then blog, which helps attackers install vulnerable plugins and could lead to more critical vulnerabilities like RCE.
Problem types: cwe_id: CWE-285
description: CWE-285 Improper Authorization
Affected products: vendor: wp-buy
product: Login Protection – Limit Failed Login Attempts
Credits: lang: en
value: Bugbang
Published: 2021-05-14T11:38:16.000Z
CVE-2021-24195 Login as User or Customer (User Switching) < 1.9 - Arbitrary Plugin Installation/Activation via Low Privilege User
Low privileged users can use the AJAX action 'cp_plugins_do_button_job_later_callback' in the Login as User or Customer (User Switching) WordPress plugin before 1.8, to install any plugin (including a specific version) from the WordPress repository, as well as activate arbitrary plugin from then blog, which helps attackers install vulnerable plugins and could lead to more critical vulnerabilities like RCE.
Problem types: cwe_id: CWE-285
description: CWE-285 Improper Authorization
Affected products: vendor: wp-buy
product: Login as User or Customer (User Switching)
Credits: lang: en
value: Bugbang
Published: 2021-05-14T11:38:16.000Z
CVE-2021-24196 Social Slider Widget < 1.8.5 - Authenticated Reflected Cross-Site Scripting (XSS)
The Social Slider Widget WordPress plugin before 1.8.5 allowed Authenticated Reflected XSS in the plugin settings page as the ‘token_error’ parameter can be controlled by users and it is directly echoed without being sanitized
Problem types: cwe_id: CWE-79
description: CWE-79 Cross-site Scripting (XSS)
Affected products: vendor: Unknown
product: Social Slider Widget
Credits: lang: en
value: purine chu
Published: 2021-04-05T18:27:45.000Z
CVE-2021-24197 wpDataTables < 3.4.2 - Improper Access Control leading to Table Permission Takeover
The wpDataTables – Tables & Table Charts premium WordPress plugin before 3.4.2 has Improper Access Control. A low privilege authenticated user that visits the page where the table is published can tamper the parameters to access the data of another user that are present in the same table by taking over the user permissions on the table through formdata[wdt_ID] parameter. By exploiting this issue an attacker is able to access and manage the data of all users in the same table.
Problem types: cwe_id: CWE-284
description: CWE-284 Improper Access Control
Affected products: vendor: wpDataTables
product: wpDataTables – Tables & Table Charts
Credits: lang: en
value: Veno Eivazian, Massimiliano Ferraresi
Published: 2021-04-12T13:58:04.000Z
CVE-2021-24198 wpDataTables < 3.4.2 - Improper Access Control leading to Table Data Deletion
The wpDataTables – Tables & Table Charts premium WordPress plugin before 3.4.2 has Improper Access Control. A low privilege authenticated user that visits the page where the table is published can tamper the parameters to delete the data of another user that are present in the same table through id_key and id_val parameters. By exploiting this issue an attacker is able to delete the data of all users in the same table.
Problem types: cwe_id: CWE-284
description: CWE-284 Improper Access Control
Affected products: vendor: wpDataTables
product: wpDataTables – Tables & Table Charts
Credits: lang: en
value: Veno Eivazian, Massimiliano Ferraresi
Published: 2021-04-12T13:58:49.000Z
CVE-2021-24199 wpDataTables < 3.4.2 - Blind SQL Injection via start Parameter
The wpDataTables – Tables & Table Charts premium WordPress plugin before 3.4.2 allows a low privilege authenticated user to perform Boolean-based blind SQL Injection in the table list page on the endpoint /wp-admin/admin-ajax.php?action=get_wdtable&table_id=1, on the 'start' HTTP POST parameter. This allows an attacker to access all the data in the database and obtain access to the WordPress application.
Problem types: cwe_id: CWE-89
description: CWE-89 SQL Injection
Affected products: vendor: wpDataTables
product: wpDataTables – Tables & Table Charts
Credits: lang: en
value: Veno Eivazian, Massimiliano Ferraresi
Published: 2021-04-12T13:59:17.000Z
CVE-2021-24200 wpDataTables < 3.4.2 - Blind SQL Injection via length Parameter
The wpDataTables – Tables & Table Charts premium WordPress plugin before 3.4.2 allows a low privilege authenticated user to perform Boolean-based blind SQL Injection in the table list page on the endpoint /wp-admin/admin-ajax.php?action=get_wdtable&table_id=1, on the 'length' HTTP POST parameter. This allows an attacker to access all the data in the database and obtain access to the WordPress application.
Problem types: cwe_id: CWE-89
description: CWE-89 SQL Injection
Affected products: vendor: wpDataTables
product: wpDataTables – Tables & Table Charts
Credits: lang: en
value: Veno Eivazian, Massimiliano Ferraresi
Published: 2021-04-12T13:59:38.000Z
CVE-2021-24201 Elementor < 3.1.2 - Authenticated Stored Cross-Site Scripting (XSS) in Column Element
In the Elementor Website Builder WordPress plugin before 3.1.4, the column element (includes/elements/column.php) accepts an ‘html_tag’ parameter. Although the element control lists a fixed set of possible html tags, it is possible for a user with Contributor or above permissions to send a modified ‘save_builder’ request containing JavaScript in the ‘html_tag’ parameter, which is not filtered and is output without escaping. This JavaScript will then be executed when the saved page is viewed or previewed.
Problem types: cwe_id: CWE-79
description: CWE-79 Cross-site Scripting (XSS)
Affected products: vendor: Unknown
product: Elementor Website Builder
Credits: lang: en
value: Ramuel Gall
Published: 2021-04-05T18:27:46.000Z
CVE-2021-24202 Elementor < 3.1.2 - Authenticated Stored Cross-Site Scripting (XSS) in Heading Widget
In the Elementor Website Builder WordPress plugin before 3.1.4, the heading widget (includes/widgets/heading.php) accepts a ‘header_size’ parameter. Although the element control lists a fixed set of possible html tags, it is possible for a user with Contributor or above permissions to send a modified ‘save_builder’ request with this parameter set to ‘script’ and combined with a ‘title’ parameter containing JavaScript, which will then be executed when the saved page is viewed or previewed.
Problem types: cwe_id: CWE-79
description: CWE-79 Cross-site Scripting (XSS)
Affected products: vendor: Unknown
product: Elementor Website Builder
Credits: lang: en
value: Ramuel Gall
Published: 2021-04-05T18:27:46.000Z
CVE-2021-24203 Elementor < 3.1.2 - Authenticated Stored Cross-Site Scripting (XSS) in Divider Widget
In the Elementor Website Builder WordPress plugin before 3.1.4, the divider widget (includes/widgets/divider.php) accepts an ‘html_tag’ parameter. Although the element control lists a fixed set of possible html tags, it is possible for a user with Contributor or above permissions to send a modified ‘save_builder’ request with this parameter set to ‘script’ and combined with a ‘text’ parameter containing JavaScript, which will then be executed when the saved page is viewed or previewed.
Problem types: cwe_id: CWE-79
description: CWE-79 Cross-site Scripting (XSS)
Affected products: vendor: Unknown
product: Elementor Website Builder
Credits: lang: en
value: Ramuel Gall
Published: 2021-04-05T18:27:46.000Z
CVE-2021-24204 Elementor < 3.1.2 - Authenticated Stored Cross-Site Scripting (XSS) in Accordion Widget
In the Elementor Website Builder WordPress plugin before 3.1.4, the accordion widget (includes/widgets/accordion.php) accepts a ‘title_html_tag’ parameter. Although the element control lists a fixed set of possible html tags, it is possible for a user with Contributor or above permissions to send a modified ‘save_builder’ request containing JavaScript in the ‘title_html_tag’ parameter, which is not filtered and is output without escaping. This JavaScript will then be executed when the saved page is viewed or previewed.
Problem types: cwe_id: CWE-79
description: CWE-79 Cross-site Scripting (XSS)
Affected products: vendor: Unknown
product: Elementor Website Builder
Credits: lang: en
value: Ramuel Gall
Published: 2021-04-05T18:27:46.000Z
CVE-2021-24205 Elementor < 3.1.2 - Authenticated Stored Cross-Site Scripting (XSS) in Icon Box Widget
In the Elementor Website Builder WordPress plugin before 3.1.4, the icon box widget (includes/widgets/icon-box.php) accepts a ‘title_size’ parameter. Although the element control lists a fixed set of possible html tags, it is possible for a user with Contributor or above permissions to send a modified ‘save_builder’ request containing JavaScript in the ‘title_size’ parameter, which is not filtered and is output without escaping. This JavaScript will then be executed when the saved page is viewed or previewed.
Problem types: cwe_id: CWE-79
description: CWE-79 Cross-site Scripting (XSS)
Affected products: vendor: Unknown
product: Elementor Website Builder
Credits: lang: en
value: Ramuel Gall
Published: 2021-04-05T18:27:46.000Z
CVE-2021-24206 Elementor < 3.1.2 - Authenticated Stored Cross-Site Scripting (XSS) in Image Box Widget
In the Elementor Website Builder WordPress plugin before 3.1.4, the image box widget (includes/widgets/image-box.php) accepts a ‘title_size’ parameter. Although the element control lists a fixed set of possible html tags, it is possible for a user with Contributor or above permissions to send a modified ‘save_builder’ request containing JavaScript in the ‘title_size’ parameter, which is not filtered and is output without escaping. This JavaScript will then be executed when the saved page is viewed or previewed.
Problem types: cwe_id: CWE-79
description: CWE-79 Cross-site Scripting (XSS)
Affected products: vendor: Unknown
product: Elementor Website Builder
Credits: lang: en
value: Ramuel Gall
Published: 2021-04-05T18:27:46.000Z
CVE-2021-24207 WP Page Builder < 1.2.4 - Insecure default configuration Allows Subscribers Editing Access to Posts
By default, the WP Page Builder WordPress plugin before 1.2.4 allows subscriber-level users to edit and make changes to any and all posts pages - user roles must be specifically blocked from editing posts and pages.
Problem types: cwe_id: CWE-863
description: CWE-863 Incorrect Authorization
Affected products: vendor: Unknown
product: WP Page Builder
Credits: lang: en
value: Ramuel Gall
Published: 2021-04-05T18:27:46.000Z
CVE-2021-24208 WP Page Builder < 1.2.4 - Multiple Stored Cross-Site scripting (XSS)
The editor of the WP Page Builder WordPress plugin before 1.2.4 allows lower-privileged users to insert unfiltered HTML, including JavaScript, into pages via the “Raw HTML” widget and the “Custom HTML” widgets (though the custom HTML widget requires sending a crafted request - it appears that this widget uses some form of client side validation but not server side validation), all of which are added via the “page_builder_data” parameter when performing the “wppb_page_save” AJAX action. It is also possible to insert malicious JavaScript via the “wppb_page_css” parameter (this can be done by closing out the style tag and opening a script tag) when performing the “wppb_page_save” AJAX action.
Problem types: cwe_id: CWE-79
description: CWE-79 Cross-site Scripting (XSS)
Affected products: vendor: Unknown
product: WP Page Builder
Credits: lang: en
value: Ramuel Gall
Published: 2021-04-05T18:27:46.000Z
CVE-2021-24209 WP Super Cache < 1.7.2 - Authenticated Remote Code Execution (RCE)
The WP Super Cache WordPress plugin before 1.7.2 was affected by an authenticated (admin+) RCE in the settings page due to input validation failure and weak $cache_path check in the WP Super Cache Settings -> Cache Location option. Direct access to the wp-cache-config.php file is not prohibited, so this vulnerability can be exploited for a web shell injection.
Problem types: description: CWE-94 Improper Control of Generation of Code ('Code Injection')
Affected products: vendor: Unknown
product: WP Super Cache
default_status: unaffected
Credits: lang: en
value: m0ze
lang: en
value: WPScan
Published: 2021-04-05T18:27:46.000Z
CVE-2021-24210 PhastPress < 1.111 - Open Redirect
There is an open redirect in the PhastPress WordPress plugin before 1.111 that allows an attacker to malform a request to a page with the plugin and then redirect the victim to a malicious page. There is also a support comment from another user one year ago (https://wordpress.org/support/topic/phast-php-used-for-remote-fetch/) that says that the php involved in the request only go to whitelisted pages but it's possible to redirect the victim to any domain.
Problem types: cwe_id: CWE-601
description: CWE-601 URL Redirection to Untrusted Site ('Open Redirect')
Affected products: vendor: Unknown
product: PhastPress
Credits: lang: en
value: Felipe Restrepo Rodriguez
Published: 2021-04-05T18:27:47.000Z
CVE-2021-24211 WordPress Related Posts <= 3.6.4 - Authenticated Stored Cross-Site Scripting (XSS)
The WordPress Related Posts plugin through 3.6.4 contains an authenticated (admin+) stored XSS vulnerability in the title field on the settings page. By exploiting that an attacker will be able to execute JavaScript code in the user's browser.
Problem types: cwe_id: CWE-79
description: CWE-79 Cross-site Scripting (XSS)
Affected products: vendor: Unknown
product: WordPress Related Posts
Credits: lang: en
value: Ganesh Bagaria
Published: 2021-04-05T18:27:47.000Z
CVE-2021-24212 WooCommerce Help Scout < 2.9.1 - Unauthenticated Arbitrary File Upload leading to RCE
The WooCommerce Help Scout WordPress plugin before 2.9.1 (https://woocommerce.com/products/woocommerce-help-scout/) allows unauthenticated users to upload any files to the site which by default will end up in wp-content/uploads/hstmp.
Problem types: cwe_id: CWE-434
description: CWE-434 Unrestricted Upload of File with Dangerous Type
Affected products: vendor: Unknown
product: WooCommerce Help Scout
Credits: lang: en
value: Ville Korhonen / Seravo
Published: 2021-04-05T18:27:47.000Z
CVE-2021-24213 GiveWP < 2.10.0 - Reflected Cross Site Scripting (XSS)
The GiveWP – Donation Plugin and Fundraising Platform WordPress plugin before 2.10.0 was affected by a reflected Cross-Site Scripting vulnerability inside of the administration panel, via the 's' GET parameter on the Donors page.
Problem types: cwe_id: CWE-79
description: CWE-79 Cross-site Scripting (XSS)
Affected products: vendor: GiveWP
product: GiveWP – Donation Plugin and Fundraising Platform
Credits: lang: en
value: Austin Bentley
Published: 2021-04-12T14:00:09.000Z
CVE-2021-24214 OpenID Connect Generic Client 3.8.0-3.8.1 - Reflected Cross Site Scripting (XSS) via Login Error
The OpenID Connect Generic Client WordPress plugin 3.8.0 and 3.8.1 did not sanitise the login error when output back in the login form, leading to a reflected Cross-Site Scripting issue. This issue does not require authentication and can be exploited with the default configuration.
Problem types: cwe_id: CWE-79
description: CWE-79 Cross-site Scripting (XSS)
Affected products: vendor: daggerhart
product: OpenID Connect Generic Client
Credits: lang: en
value: Austin Bentley
Published: 2021-05-05T18:39:42.000Z
CVE-2021-24215 Controlled Admin Access < 1.5.2 - Improper Access Control & Privilege Escalation
An Improper Access Control vulnerability was discovered in the Controlled Admin Access WordPress plugin before 1.5.2. Uncontrolled access to the website customization functionality and global CMS settings, like /wp-admin/customization.php and /wp-admin/options.php, can lead to a complete compromise of the target resource.
Problem types: cwe_id: CWE-284
description: CWE-284 Improper Access Control
Affected products: vendor: Unknown
product: Controlled Admin Access
Credits: lang: en
value: m0ze
Published: 2021-04-12T14:00:48.000Z
CVE-2021-24216 All-in-One WP Migration < 7.41 - Admin+ Arbitrary File Upload to RCE
The All-in-One WP Migration WordPress plugin before 7.41 does not validate uploaded files' extension, which allows administrators to upload PHP files on their site, even on multisite installations.
Problem types: cwe_id: CWE-434
description: CWE-434 Unrestricted Upload of File with Dangerous Type
Affected products: vendor: Unknown
product: All-in-One WP Migration
Credits: lang: en
value: YICHENG LIU-ZTE CHENFENG lab
Published: 2022-03-07T08:15:55.000Z
CVE-2021-24217 Facebook for WordPress < 3.0.0 - PHP Object Injection with POP Chain
The run_action function of the Facebook for WordPress plugin before 3.0.0 deserializes user supplied data making it possible for PHP objects to be supplied creating an Object Injection vulnerability. There was also a useable magic method in the plugin that could be used to achieve remote code execution.
Problem types: cwe_id: CWE-502
description: CWE-502 Deserialization of Untrusted Data
Affected products: vendor: Unknown
product: Facebook for WordPress
Credits: lang: en
value: Chloe Chamberland
Published: 2021-04-12T14:01:19.000Z
CVE-2021-24218 Facebook for WordPress 3.0.0-3.0.3 - CSRF to Stored XSS and Settings Deletion
The wp_ajax_save_fbe_settings and wp_ajax_delete_fbe_settings AJAX actions of the Facebook for WordPress plugin before 3.0.4 were vulnerable to CSRF due to a lack of nonce protection. The settings in the saveFbeSettings function had no sanitization allowing for script tags to be saved.
Problem types: cwe_id: CWE-352
description: CWE-352 Cross-Site Request Forgery (CSRF)
Affected products: vendor: Unknown
product: Facebook for WordPress
Credits: lang: en
value: Chloe Chamberland
Published: 2021-04-12T14:01:34.000Z