rainbutterfly/cve_corpus huggingface dataset:
CVE-2021-24620 Simple eCommerce <= 2.2.5 - Arbitrary File Upload
The WordPress Simple Ecommerce Shopping Cart Plugin- Sell products through Paypal plugin through 2.2.5 does not check for the uploaded Downloadable Digital product file, allowing any file, such as PHP to be uploaded by an administrator. Furthermore, as there is no CSRF in place, attackers could also make a logged admin upload a malicious PHP file, which would lead to RCE
Problem types: cwe_id: CWE-434
description: CWE-434 Unrestricted Upload of File with Dangerous Type
Affected products: vendor: Unknown
product: WordPress Simple Ecommerce Shopping Cart Plugin- Sell products through Paypal
Credits: lang: en
value: h3v0x
Published: 2021-09-13T17:56:33.000Z
CVE-2021-24621 WP Courses LMS < 2.0.44 - Authenticated Stored XSS via Video Embed Code
The WP Courses LMS WordPress plugin before 2.0.44 does not sanitise its Video Embed Code, allowing malicious code to be injected in it by high privilege users, even when the unfiltered_html capability is disallowed, which could lead to Stored Cross-Site Scripting issues
Problem types: cwe_id: CWE-79
description: CWE-79 Cross-site Scripting (XSS)
Affected products: vendor: Unknown
product: WP Courses LMS
Credits: lang: en
value: Tri Wanda Septian
Published: 2021-09-13T17:56:34.000Z
CVE-2021-24622 WP Ticket < 5.10.4 - Admin+ Stored Cross-Site Scripting
The Customer Service Software & Support Ticket System WordPress plugin before 5.10.4 does not sanitize or escape form fields before outputting it in the List, which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed.
Problem types: cwe_id: CWE-79
description: CWE-79 Cross-site Scripting (XSS)
Affected products: vendor: Unknown
product: Customer Service Software & Support Ticket System
Credits: lang: en
value: Tri Wanda Septian
Published: 2021-10-18T13:45:50.000Z
CVE-2021-24623 WordPress Advanced Ticket System < 1.0.64 - Authenticated Stored Cross-Site Scripting (XSS)
The WordPress Advanced Ticket System, Elite Support Helpdesk WordPress plugin before 1.0.64 does not sanitize or escape form values before saving to the database or when outputting, which allows high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed.
Problem types: cwe_id: CWE-79
description: CWE-79 Cross-site Scripting (XSS)
Affected products: vendor: Unknown
product: WordPress Advanced Ticket System, Elite Support Helpdesk
Credits: lang: en
value: Tri Wanda Septian
Published: 2021-09-13T17:56:36.000Z
CVE-2021-24624 MP3 Audio Player for Music, Radio & Podcast by Sonaar < 2.4.2 - Multiple Admin+ Cross Site Scripting
The MP3 Audio Player for Music, Radio & Podcast by Sonaar WordPress plugin before 2.4.2 does not properly sanitize or escape data in some of its Playlist settings, allowing high privilege users to perform Cross-Site Scripting attacks
Problem types: cwe_id: CWE-79
description: CWE-79 Cross-site Scripting (XSS)
Affected products: vendor: Unknown
product: MP3 Audio Player for Music, Radio & Podcast by Sonaar
Credits: lang: en
value: apple502j
Published: 2021-11-01T08:46:03.000Z
CVE-2021-24625 SpiderCatalog <= 1.7.3 - Admin+ SQL Injection
The SpiderCatalog WordPress plugin through 1.7.3 does not sanitise or escape the 'parent' and 'ordering' parameters from the admin dashboard before using them in a SQL statement, leading to a SQL injection when adding a category
Problem types: cwe_id: CWE-89
description: CWE-89 SQL Injection
Affected products: vendor: Unknown
product: SpiderCatalog
Credits: lang: en
value: Shreya Pohekar of Codevigilant Project
Published: 2021-11-08T17:34:48.000Z
CVE-2021-24626 Chameleon CSS <= 1.2 - Subscriber+ SQL Injection
The Chameleon CSS WordPress plugin through 1.2 does not have any CSRF and capability checks in all its AJAX calls, allowing any authenticated user, such as subscriber to call them and perform unauthorised actions. One of AJAX call, remove_css, also does not sanitise or escape the css_id POST parameter before using it in a SQL statement, leading to a SQL Injection
Problem types: cwe_id: CWE-89
description: CWE-89 SQL Injection
cwe_id: CWE-352
description: CWE-352 Cross-Site Request Forgery (CSRF)
Affected products: vendor: Unknown
product: Chameleon CSS
Credits: lang: en
value: Shreya Pohekar of Codevigilant Project
Published: 2021-11-08T17:34:49.000Z
CVE-2021-24627 G Auto-Hyperlink <= 1.0.1 - Admin+ SQL Injection
The G Auto-Hyperlink WordPress plugin through 1.0.1 does not sanitise or escape an 'id' GET parameter before using it in a SQL statement, to select data to be displayed in the admin dashboard, leading to an authenticated SQL injection
Problem types: cwe_id: CWE-89
description: CWE-89 SQL Injection
Affected products: vendor: Unknown
product: G Auto-Hyperlink
Credits: lang: en
value: Shreya Pohekar of Codevigilant Project
Published: 2021-11-08T17:34:50.000Z
CVE-2021-24628 Wow Forms <= 3.1.3 - Admin+ SQL Injection
The Wow Forms WordPress plugin through 3.1.3 does not sanitise or escape a 'did' GET parameter before using it in a SQL statement, when deleting a form in the admin dashboard, leading to an authenticated SQL injection
Problem types: cwe_id: CWE-89
description: CWE-89 SQL Injection
Affected products: vendor: Unknown
product: Wow Forms – create any form with custom style
Credits: lang: en
value: Shreya Pohekar of Codevigilant Project
Published: 2021-11-08T17:34:51.000Z
CVE-2021-24629 Post Content XMLRPC <= 1.0 - Admin+ SQL Injections
The Post Content XMLRPC WordPress plugin through 1.0 does not sanitise or escape multiple GET/POST parameters before using them in SQL statements in the admin dashboard, leading to an authenticated SQL Injections
Problem types: cwe_id: CWE-89
description: CWE-89 SQL Injection
Affected products: vendor: Unknown
product: Post Content XMLRPC
Credits: lang: en
value: Shreya Pohekar of Codevigilant Project
Published: 2021-11-08T17:34:52.000Z
CVE-2021-24630 Schreikasten <= 0.14.18 - Author+ SQL Injections
The Schreikasten WordPress plugin through 0.14.18 does not sanitise or escape the id GET parameter before using it in SQL statements in the comments dashboard from various actions, leading to authenticated SQL Injections which can be exploited by users as low as author
Problem types: cwe_id: CWE-89
description: CWE-89 SQL Injection
Affected products: vendor: Unknown
product: Schreikasten
Credits: lang: en
value: Shreya Pohekar of Codevigilant Project
Published: 2021-11-08T17:34:53.000Z
CVE-2021-24631 Unlimited PopUps <= 4.5.3 - Author+ SQL Injection
The Unlimited PopUps WordPress plugin through 4.5.3 does not sanitise or escape the did GET parameter before using it in a SQL statement, available to users as low as editor, leading to an authenticated SQL Injection
Problem types: cwe_id: CWE-89
description: CWE-89 SQL Injection
Affected products: vendor: Unknown
product: Unlimited PopUps
Credits: lang: en
value: Shreya Pohekar of Codevigilant Project
Published: 2021-11-08T17:34:54.000Z
CVE-2021-24632 Recipe Card Blocks < 2.8.1 - Reflected Cross-Site Scripting
The Recipe Card Blocks by WPZOOM WordPress plugin before 2.8.1 does not escape the message parameter before outputting it back in the admin dashboard, leading to a Reflected Cross-Site Scripting issue
Problem types: cwe_id: CWE-79
description: CWE-79 Cross-site Scripting (XSS)
Affected products: vendor: Unknown
product: Recipe Card Blocks by WPZOOM
Credits: lang: en
value: apple502j
Published: 2021-09-27T15:25:24.000Z
CVE-2021-24633 Countdown Block < 1.1.2 - Missing Authorisation in AJAX action
The Countdown Block WordPress plugin before 1.1.2 does not have authorisation in the eb_write_block_css AJAX action, which allows any authenticated user, such as Subscriber, to modify post contents displayed to users.
Problem types: cwe_id: CWE-862
description: CWE-862 Missing Authorization
Affected products: vendor: Unknown
product: Countdown Block
Credits: lang: en
value: apple502j
Published: 2021-09-27T15:25:26.000Z
CVE-2021-24634 Recipe Card Blocks < 2.8.3 - Contributor+ Stored Cross-Site Scripting
The Recipe Card Blocks by WPZOOM WordPress plugin before 2.8.3 does not properly sanitise or escape some of the properties of the Recipe Card Block (such as ingredientsLayout, iconSet, steps, ingredients, recipeTitle, or settings), which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks.
Problem types: cwe_id: CWE-79
description: CWE-79 Cross-site Scripting (XSS)
Affected products: vendor: Unknown
product: Recipe Card Blocks by WPZOOM
Credits: lang: en
value: apple502j
Published: 2021-09-27T15:25:27.000Z
CVE-2021-24635 Visual Link Preview < 2.2.3 - Unauthorised AJAX Calls
The Visual Link Preview WordPress plugin before 2.2.3 does not enforce authorisation on several AJAX actions and has the CSRF nonce displayed for all authenticated users, allowing any authenticated user (such as subscriber) to call them and 1) Get and search through title and content of Draft post, 2) Get title of a password-protected post as well as 3) Upload an image from an URL
Problem types: cwe_id: CWE-284
description: CWE-284 Improper Access Control
Affected products: vendor: Unknown
product: Visual Link Preview
Credits: lang: en
value: apple502j
Published: 2021-09-20T10:06:38.000Z
CVE-2021-24636 Print My Blog < 3.4.2 - Plugin Deactivation via CSRF
The Print My Blog WordPress Plugin before 3.4.2 does not enforce nonce (CSRF) checks, which allows attackers to make logged in administrators deactivate the Print My Blog plugin and delete all saved data for that plugin by tricking them to open a malicious link
Problem types: cwe_id: CWE-352
description: CWE-352 Cross-Site Request Forgery (CSRF)
Affected products: vendor: Unknown
product: Print My Blog – Print, PDF, & eBook Converter WordPress Plugin
Credits: lang: en
value: apple502j
Published: 2021-09-20T10:06:40.000Z
CVE-2021-24637 Fonts Plugin < 3.0.3 - Contributor+ Stored Cross-Site Scripting
The Google Fonts Typography WordPress plugin before 3.0.3 does not escape and sanitise some of its block settings, allowing users with as role as low as Contributor to perform Stored Cross-Site Scripting attacks via blockType (combined with content), align, color, variant and fontID argument of a Gutenberg block.
Problem types: cwe_id: CWE-79
description: CWE-79 Cross-site Scripting (XSS)
Affected products: vendor: Unknown
product: Fonts Plugin | Google Fonts Typography
Credits: lang: en
value: apple502j
Published: 2021-09-20T10:06:42.000Z
CVE-2021-24638 OMGF < 4.5.4 - Unauthenticated Path Traversal in REST API
The OMGF WordPress plugin before 4.5.4 does not escape or validate the handle parameter of the REST API, which allows unauthenticated users to perform path traversal and overwrite arbitrary CSS file with Google Fonts CSS, or download fonts uploaded on Google Fonts website.
Problem types: cwe_id: CWE-22
description: CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Affected products: vendor: Unknown
product: OMGF | Host Google Fonts Locally
Credits: lang: en
value: apple502j
Published: 2021-09-20T10:06:43.000Z
CVE-2021-24639 OMGF < 4.5.4 - Subscriber+ Arbitrary File/Folder Deletion
The OMGF WordPress plugin before 4.5.4 does not enforce path validation, authorisation and CSRF checks in the omgf_ajax_empty_dir AJAX action, which allows any authenticated users to delete arbitrary files or folders on the server.
Problem types: cwe_id: CWE-862
description: CWE-862 Missing Authorization
cwe_id: CWE-22
description: CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
cwe_id: CWE-352
description: CWE-352 Cross-Site Request Forgery (CSRF)
Affected products: vendor: Unknown
product: OMGF | Host Google Fonts Locally
Credits: lang: en
value: apple502j
Published: 2021-09-20T10:06:45.000Z
CVE-2021-24640 Gutenslider < 5.2.0 - Contributor+ Stored XSS
The WordPress Slider Block Gutenslider plugin before 5.2.0 does not escape the minWidth attribute of a Gutenburg block, which could allow users with a role as low as contributor to perform Cross-Site Scripting attacks
Problem types: cwe_id: CWE-79
description: CWE-79 Cross-site Scripting (XSS)
Affected products: vendor: Unknown
product: WordPress Slider Block Gutenslider
Credits: lang: en
value: apple502j
Published: 2021-09-20T10:06:46.000Z
CVE-2021-24641 Images to WebP < 1.9 - Multiple Cross Site Request Forgery (CSRF)
The Images to WebP WordPress plugin before 1.9 does not have CSRF checks in place when performing some administrative actions, which could result in modification of plugin settings, Denial-of-Service, as well as arbitrary image conversion
Problem types: cwe_id: CWE-352
description: CWE-352 Cross-Site Request Forgery (CSRF)
Affected products: vendor: Unknown
product: Images to WebP
Credits: lang: en
value: apple502j
Published: 2021-11-23T19:16:01.000Z
CVE-2021-24642 Scroll Baner <= 1.0 - CSRF to RCE
The Scroll Baner WordPress plugin through 1.0 does not have CSRF check in place when saving its settings, nor perform any sanitisation, escaping or validation on them. This could allow attackers to make logged in admin change them and could lead to RCE (via a file upload) as well as XSS
Problem types: cwe_id: CWE-352
description: CWE-352 Cross-Site Request Forgery (CSRF)
cwe_id: CWE-79
description: CWE-79 Cross-site Scripting (XSS)
Affected products: vendor: Unknown
product: Scroll Baner
Credits: lang: en
value: Chuang Li
Published: 2021-10-18T13:45:52.000Z
CVE-2021-24643 WP Map Block < 1.2.3 - Contributor+ Stored Cross-Site Scripting
The WP Map Block WordPress plugin before 1.2.3 does not escape some attributes of the WP Map Block, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks
Problem types: cwe_id: CWE-79
description: CWE-79 Cross-site Scripting (XSS)
Affected products: vendor: Unknown
product: WP Map Block – Gutenberg Map Block for Google Map and OpenStreet Map
Credits: lang: en
value: apple502j
Published: 2021-09-27T15:25:29.000Z
CVE-2021-24644 Images to WebP < 1.9 - Authenticated Local File Inclusion
The Images to WebP WordPress plugin before 1.9 does not validate or sanitise the tab parameter before passing it to the include() function, which could lead to a Local File Inclusion issue
Problem types: cwe_id: CWE-22
description: CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Affected products: vendor: Unknown
product: Images to WebP
Credits: lang: en
value: apple502j
Published: 2021-11-23T19:16:03.000Z
CVE-2021-24645 Booking.com Product Helper < 1.0.2 - Admin+ Stored Cross-Site Scripting
The Booking.com Product Helper WordPress plugin before 1.0.2 does not sanitize and escape Product Code when creating Product Shortcode, which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed
Problem types: cwe_id: CWE-79
description: CWE-79 Cross-site Scripting (XSS)
Affected products: vendor: Unknown
product: Booking.com Product Helper
Credits: lang: en
value: Asif Nawaz Minhas
Published: 2021-11-08T17:34:55.000Z
CVE-2021-24646 Booking.com Banner Creator < 1.4.3 - Admin+ Stored Cross-Site Scripting
The Booking.com Banner Creator WordPress plugin before 1.4.3 does not properly sanitize inputs when creating banners, which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed
Problem types: cwe_id: CWE-79
description: CWE-79 Cross-site Scripting (XSS)
Affected products: vendor: Unknown
product: Booking.com Banner Creator
Credits: lang: en
value: Asif Nawaz Minhas
Published: 2021-11-08T17:34:56.000Z
CVE-2021-24647 Pie Register < 3.7.1.6 - Unauthenticated Arbitrary Login
The Registration Forms – User profile, Content Restriction, Spam Protection, Payment Gateways, Invitation Codes WordPress plugin before 3.1.7.6 has a flaw in the social login implementation, allowing unauthenticated attacker to login as any user on the site by only knowing their user ID or username
Problem types: cwe_id: CWE-287
description: CWE-287 Improper Authentication
Affected products: vendor: Unknown
product: Registration Forms – User profile, Content Restriction, Spam Protection, Payment Gateways, Invitation Codes
Credits: lang: en
value: AyeCode Ltd
Published: 2021-11-08T17:34:57.000Z
CVE-2021-24648 Registration Magic < 5.0.1.9 - Reflected Cross-Site Scripting
The RegistrationMagic WordPress plugin before 5.0.1.9 does not sanitise and escape the rm_search_value parameter before outputting back in an attribute, leading to a Reflected Cross-Site Scripting
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Credits: lang: en
value: AyeCode Ltd
Published: 2022-02-01T12:21:19.000Z
CVE-2021-24649 WP User Frontend < 3.5.29 - Obscure Registration as Admin
The WP User Frontend WordPress plugin before 3.5.29 uses a user supplied argument called urhidden in its registration form, which contains the role for the account to be created with, encrypted via wpuf_encryption(). This could allow an attacker having access to the AUTH_KEY and AUTH_SALT constant (via an arbitrary file access issue for example, or if the blog is using the default keys) to create an account with any role they want, such as admin
Problem types: description: CWE-287 Improper Authentication
Affected products: vendor: Unknown
product: WP User Frontend
default_status: unaffected
Credits: lang: en
value: AyeCode Ltd
Published: 2022-11-21T00:00:00.000Z
CVE-2021-24651 Poll Maker < 3.4.2 - Unauthenticated Time Based SQL Injection
The Poll Maker WordPress plugin before 3.4.2 allows unauthenticated users to perform SQL injection via the ays_finish_poll AJAX action. While the result is not disclosed in the response, it is possible to use a timing attack to exfiltrate data such as password hash.
Problem types: cwe_id: CWE-89
description: CWE-89 SQL Injection
cwe_id: CWE-203
description: CWE-203 Observable Discrepancy
Affected products: vendor: Unknown
product: Poll Maker
Credits: lang: en
value: apple502j
Published: 2021-10-11T10:45:35.000Z
CVE-2021-24652 PostX Gutenberg Blocks for Post Grid < 2.4.10 - Missing Access Controls
The PostX – Gutenberg Blocks for Post Grid WordPress plugin before 2.4.10 performs incorrect checks before allowing any logged in user to perform some ajax based requests, allowing any user to modify, delete or add ultp_options values.
Problem types: cwe_id: CWE-863
description: CWE-863 Incorrect Authorization
Affected products: vendor: Unknown
product: PostX – Gutenberg Blocks for Post Grid
Credits: lang: en
value: apple502j
Published: 2021-09-27T15:25:30.000Z
CVE-2021-24653 Cookie Bar < 1.8.9 - Admin+ Stored Cross-Site Scripting
The Cookie Bar WordPress plugin before 1.8.9 doesn't properly sanitise the Cookie Bar Message setting, which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed
Problem types: cwe_id: CWE-79
description: CWE-79 Cross-Site Scripting (XSS)
Affected products: vendor: Unknown
product: Cookie Bar
Credits: lang: en
value: pang0lin@webray.com.cn inc
Published: 2021-10-25T13:20:47.000Z
CVE-2021-24654 User Registration < 2.0.2 - Low Privilege Stored Cross-Site Scripting
The User Registration WordPress plugin before 2.0.2 does not properly sanitise the user_registration_profile_pic_url value when submitted directly via the user_registration_update_profile_details AJAX action. This could allow any authenticated user, such as subscriber, to perform Stored Cross-Site attacks when their profile is viewed
Problem types: cwe_id: CWE-79
description: CWE-79 Cross-site Scripting (XSS)
Affected products: vendor: Unknown
product: User Registration – Custom Registration Form, Login And User Profile For WordPress
Credits: lang: en
value: AyeCode Ltd
Published: 2021-10-04T11:20:17.000Z
CVE-2021-24655 WP User Manager < 2.6.3 - Arbitrary User Password Reset to Account Compromise
The WP User Manager WordPress plugin before 2.6.3 does not ensure that the user ID to reset the password of is related to the reset key given. As a result, any authenticated user can reset the password (to an arbitrary value) of any user knowing only their ID, and gain access to their account.
Problem types: cwe_id: CWE-639
description: CWE-639 Authorization Bypass Through User-Controlled Key
Affected products: vendor: Unknown
product: WP User Manager – User Profile Builder & Membership
Credits: lang: en
value: AyeCode Ltd
Published: 2022-07-17T10:35:28.000Z
CVE-2021-24656 Simple Social Media Share Buttons < 3.2.4 - Authenticated Stored Cross-Site Scripting
The Simple Social Media Share Buttons WordPress plugin before 3.2.4 does not escape the Share Title settings before outputting it in the frontend pages or posts (depending on the settings used), allowing high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed.
Problem types: cwe_id: CWE-79
description: CWE-79 Cross-site Scripting (XSS)
Affected products: vendor: Unknown
product: Simple Social Media Share Buttons – Social Sharing for Everyone
Credits: lang: en
value: Asif Nawaz Minhas
Published: 2021-10-11T10:45:36.000Z
CVE-2021-24657 Limit Login Attempts < 4.0.50 - Unauthenticated Stored Cross-Site Scripting
The Limit Login Attempts WordPress plugin before 4.0.50 does not escape the IP addresses (which can be controlled by attacker via headers such as X-Forwarded-For) of attempted logins before outputting them in the reports table, leading to an Unauthenticated Stored Cross-Site Scripting issue.
Problem types: cwe_id: CWE-79
description: CWE-79 Cross-site Scripting (XSS)
Affected products: vendor: Unknown
product: Limit Login Attempts
Credits: lang: en
value: wuzhenyu
Published: 2021-09-20T10:06:48.000Z
CVE-2021-24658 Erident Custom Login and Dashboard < 3.5.9 - Authenticated Stored Cross-Site Scripting (XSS)
The Erident Custom Login and Dashboard WordPress plugin before 3.5.9 did not properly sanitise its settings, allowing high privilege users to use XSS payloads in them (even when the unfileted_html is disabled)
Problem types: cwe_id: CWE-79
description: CWE-79 Cross-site Scripting (XSS)
Affected products: vendor: Libin V Babu
product: Erident Custom Login and Dashboard
Credits: lang: en
value: James Calver (Bulletproof Cyber)
Published: 2021-08-23T11:10:20.000Z
CVE-2021-24659 PostX Gutenberg Blocks for Post Grid < 2.4.10 - Contributor+ Stored Cross-Site Scripting
The PostX – Gutenberg Blocks for Post Grid WordPress plugin before 2.4.10 allows users with a role as low as Contributor to perform Stored Cross-Site Scripting attacks via the plugin's block.
Problem types: cwe_id: CWE-79
description: CWE-79 Cross-site Scripting (XSS)
Affected products: vendor: Unknown
product: PostX – Gutenberg Blocks for Post Grid
Credits: lang: en
value: apple502j
Published: 2021-09-27T15:25:32.000Z
CVE-2021-24660 PostX Gutenberg Blocks Saved Templates Addon < 2.4.10 - Contributor+ Stored Cross-Site Scripting
The PostX – Gutenberg Blocks for Post Grid WordPress plugin before 2.4.10, with Saved Templates Addon enabled, allows users with a role as low as Contributor to perform Stored Cross-Site Scripting attacks via the plugin's shortcode.
Problem types: cwe_id: CWE-79
description: CWE-79 Cross-site Scripting (XSS)
Affected products: vendor: Unknown
product: PostX – Gutenberg Blocks for Post Grid
Credits: lang: en
value: apple502j
Published: 2021-09-27T15:25:33.000Z
CVE-2021-24661 PostX Gutenberg Blocks Saved Templates Addon < 2.4.10 - Private Content Disclosure
The PostX – Gutenberg Blocks for Post Grid WordPress plugin before 2.4.10, with Saved Templates Addon enabled, allows users with Contributor roles or higher to read password-protected or private post contents the user is otherwise unable to read, given the post ID.
Problem types: cwe_id: CWE-200
description: CWE-200 Information Exposure
Affected products: vendor: Unknown
product: PostX – Gutenberg Blocks for Post Grid
Credits: lang: en
value: apple502j
Published: 2021-09-27T15:25:35.000Z