Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 24

Export CSV
CVE-2021-24720

GeoDirectory < 2.1.1.3 - Authenticated Stored Cross-Site Scripting (XSS)

The GeoDirectory Business Directory WordPress plugin before 2.1.1.3 was vulnerable to Authenticated Stored Cross-Site Scripting (XSS).

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed
Vendors
Ayecode
Products
Geodirectory
CVE-2021-24369

GetPaid < 2.3.4 - Authenticated Stored XSS

In the GetPaid WordPress plugin before 2.3.4, users with the contributor role and above can create a new Payment Form, however the Label and Help Text input fields were not getting sanitized properly. So it was possible to inject malicious content such as img tags, leading to a Stored Cross-Site Scripting issue which is triggered when the form will be edited, for example when an admin reviews it and could lead to privilege escalation.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed
Vendors
Ayecode
Products
Getpaid
CVE-2021-24361

GeoDirectory Location Manager < 2.1.0.10 - Multiple Unauthenticated SQL Injections

In the Location Manager WordPress plugin before 2.1.0.10, the AJAX action gd_popular_location_list did not properly sanitise or validate some of its POST parameters, which are then used in a SQL statement, leading to unauthenticated SQL Injection issues.

CVSS 3.1 · 9.8 Critical EPSS 1.8% KEV · Not listed
Vendors
Ayecode
Products
Location Manager
CVE-2024-43981

WordPress GeoDirectory plugin <= 2.3.70 - Broken Access Control vulnerability

Missing Authorization vulnerability in AyeCode – WP Business Directory Plugins GeoDirectory allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects GeoDirectory: from n/a through 2.3.70.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed
Vendors
Ayecode
Products
Geodirectory