CVE-2021-24555

Diary & Availability Calendar <= 1.0.3 - Authenticated (subscriber+) SQL Injection

The daac_delete_booking_callback function, hooked to the daac_delete_booking AJAX action, takes the id POST parameter which is passed into the SQL statement without proper sanitisation, validation or escaping, leading to a SQL Injection issue. Furthermore, the ajax action is lacking any CSRF and capability check, making it available to any authenticated user.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

Roosty

Products

Diary-availability-calendar

CVE-2021-24543

jQuery Reply to Comment <= 1.31 - CSRF to Stored Cross-Site Scripting

The jQuery Reply to Comment WordPress plugin through 1.31 does not have any CSRF check when saving its settings, nor sanitise or escape its 'Quote String' and 'Reply String' settings before outputting them in Comments, leading to a Stored Cross-Site Scripting issue.

CVSS 3.1 · 6.1 Medium EPSS < 1% KEV · Not listed

Vendors

Jquery-reply-to-comment Project

Products

Jquery-reply-to-comment

CVE-2021-24536

Custom Login Redirect <= 1.0.0 - CSRF to Stored XSS

The Custom Login Redirect WordPress plugin through 1.0.0 does not have CSRF check in place when saving its settings, and do not sanitise or escape user input before outputting them back in the page, leading to a Stored Cross-Site Scripting issue

CVSS 3.1 · 6.1 Medium EPSS < 1% KEV · Not listed

Vendors

Custom Login Redirect Project

Products

Custom Login Redirect

CVE-2021-24535

Light Messages <= 1.0 - CSRF to Stored XSS

The Light Messages WordPress plugin through 1.0 is lacking CSRF check when updating it's settings, and is not sanitising its Message Content in them (even with the unfiltered_html disallowed). As a result, an attacker could make a logged in admin update the settings to arbitrary values, and set a Cross-Site Scripting payload in the Message Content. Depending on the options set, the XSS payload can be triggered either in the backend only (in the plugin's settings), or both frontend and backend.

CVSS 3.1 · 6.1 Medium EPSS < 1% KEV · Not listed

Vendors

Light Messages Project

Products

Light Messages

CVE-2021-24504

WP LMS <= 1.1.2 - Stored Cross-Site Scripting (XSS)

The WP LMS – Best WordPress LMS Plugin WordPress plugin through 1.1.2 does not properly sanitise or validate its User Field Titles, allowing XSS payload to be used in them. Furthermore, no CSRF and capability checks were in place, allowing such attack to be performed either via CSRF or as any user (including unauthenticated)

CVSS 3.1 · 6.1 Medium EPSS < 1% KEV · Not listed

Vendors

Wplearnmanager

Products

Wp Learn Manager

CVE-2021-24500

Workreap theme < 2.2.2 - Multiple CSRF + IDOR Vulnerabilities

Several AJAX actions available in the Workreap WordPress theme before 2.2.2 lacked CSRF protections, as well as allowing insecure direct object references that were not validated. This allows an attacker to trick a logged in user to submit a POST request to the vulnerable site, potentially modifying or deleting arbitrary objects on the target site.

CVSS 3.1 · 8.1 High EPSS < 1% KEV · Not listed

Vendors

Amentotech

Products

Workreap

CVE-2021-24491

Fileviewer <= 2.2 - Arbitrary File Upload/Deletion via CSRF

The Fileviewer WordPress plugin through 2.2 does not have CSRF checks in place when performing actions such as upload and delete files. As a result, attackers could make a logged in administrator delete and upload arbitrary files via a CSRF attack

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

Fileviewer Project

Products

Fileviewer

CVE-2021-24490

Email Artillery <= 4.1 - Arbitrary File Upload

The Email Artillery (MASS EMAIL) WordPress plugin through 4.1 does not properly check the uploaded files from the Import Emails feature, allowing arbitrary files to be uploaded. Furthermore, the plugin is also lacking any CSRF check, allowing such issue to be exploited via a CSRF attack as well. However, due to the presence of a .htaccess, denying access to everything in the folder the file is uploaded to, the malicious uploaded file will only be accessible on Web Servers such as Nginx/IIS

CVSS 3.1 · 6.8 Medium EPSS < 1% KEV · Not listed

Vendors

Email Artillery Project

Products

Email Artillery

CVE-2021-24487

St Daily Tip <= 4.7 - CSRF to Stored Cross-Site Scripting

The St-Daily-Tip WordPress plugin through 4.7 does not have any CSRF check in place when saving its 'Default Text to Display if no tips' setting, and was also lacking sanitisation as well as escaping before outputting it the page. This could allow attacker to make logged in administrators set a malicious payload in it, leading to a Stored Cross-Site Scripting issue

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

Sanskruti

Products

St-daily-tip

CVE-2021-24477

Migrate Users <= 1.0.1 - CSRF to Stored Cross-Site Scripting (XSS)

The Migrate Users WordPress plugin through 1.0.1 does not sanitise or escape its Delimiter option before outputting in a page, leading to a Stored Cross-Site Scripting issue. Furthermore, the plugin does not have CSRF check in place when saving its options, allowing the issue to be exploited via a CSRF attack.

CVSS 3.1 · 6.1 Medium EPSS < 1% KEV · Not listed

Vendors

Migrate Users Project

Products

Migrate Users

CVE-2021-24467

Leaflet Map < 3.0.0 - Arbitrary Settings Update via CSRF Leading to Stored XSS

The Leaflet Map WordPress plugin before 3.0.0 does not verify the CSRF nonce when saving its settings, which allows attackers to make a logged in admin update the settings via a Cross-Site Request Forgery attack. This could lead to Cross-Site Scripting issues by either changing the URL of the JavaScript library being used, or using malicious attributions which will be executed in all page with an embed map from the plugin

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Leaflet Map Project

Products

Leaflet Map

CVE-2021-24466

Verse-O-Matic <= 4.1.1 - CSRF to Stored XSS

The Verse-O-Matic WordPress plugin through 4.1.1 does not have any CSRF checks in place, allowing attackers to make logged in administrators do unwanted actions, such as add/edit/delete arbitrary verses and change the settings. Due to the lack of sanitisation in the settings and verses, this could also lead to Stored Cross-Site Scripting issues

CVSS 3.1 · 6.1 Medium EPSS < 1% KEV · Not listed

Vendors

Verse-o-matic Project

Products

Verse-o-matic

CVE-2021-24446

Remove Footer Credit < 1.0.6 - CSRF to Stored Cross-Site Scripting

The Remove Footer Credit WordPress plugin before 1.0.6 does not have CSRF check in place when saving its settings, which could allow attacker to make logged in admins change them and lead to Stored XSS issue as well due to the lack of sanitisation

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed

Vendors

Wpchill

Products

Remove Footer Credit

CVE-2021-24434

Glass <= 1.3.2 - CSRF to Stored Cross-Site Scripting (XSS)

The Glass WordPress plugin through 1.3.2 does not sanitise or escape its "Glass Pages" setting before outputting in a page, leading to a Stored Cross-Site Scripting issue. Furthermore, the plugin did not have CSRF check in place when saving its settings, allowing the issue to be exploited via a CSRF attack.

CVSS 3.1 · 6.1 Medium EPSS < 1% KEV · Not listed

Vendors

Codeblab

Products

Glass

CVE-2021-24431

Language Bar Flags <= 1.0.8 - CSRF to Stored XSS

The Language Bar Flags WordPress plugin through 1.0.8 does not have any CSRF in place when saving its settings and did not sanitise or escape them when generating the flag bar in the frontend. This could allow attackers to make a logged in admin change the settings, and set Cross-Site Scripting payload in them, which will be executed in the frontend for all users

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed

Vendors

Language Bar Flags Project

Products

Language Bar Flags

CVE-2021-24411

Social Tape <= 1.0 - CSRF to Stored XSS

The Social Tape WordPress plugin through 1.0 does not have CSRF checks in place when saving its settings, and do not sanitise or escape them before outputting them back in the page, leading to a stored Cross-Site Scripting issue via a CSRF attack

CVSS 3.1 · 6.1 Medium EPSS < 1% KEV · Not listed

Vendors

Social Tape Project

Products

Social Tape

CVE-2021-24410

Telugu Bible Verse Daily <= 1.0 - CSRF to Stored XSS

The తెలుగు బైబిల్ వచనములు WordPress plugin through 1.0 is lacking any CSRF check when saving its settings and verses, and do not sanitise or escape them when outputting them back in the page. This could allow attackers to make a logged in admin change the settings, as well as add malicious verses containing JavaScript code in them, leading to Stored XSS issues

CVSS 3.1 · 6.1 Medium EPSS < 1% KEV · Not listed

Vendors

Telugu Bible Verse Daily Project

Products

Telugu Bible Verse Daily

CVE-2021-24388

Vik Rent Car < 1.1.7 - CSRF to Stored XSS

In the VikRentCar Car Rental Management System WordPress plugin before 1.1.7, there is a custom filed option by which we can manage all the fields that the users will have to fill in before saving the order. However, the field name is not sanitised or escaped before being output back in the page, leading to a stored Cross-Site Scripting issue. There is also no CSRF check done before saving the setting, allowing attackers to make a logged in admin set arbitrary Custom Fields, including one with XSS payload in it.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed

Vendors

E4j

Products

Vikrentcar Car Rental Management System

CVE-2021-24380

Shantz WordPress QOTD <= 1.2.2 - Arbitrary Setting Update via CSRF

The Shantz WordPress QOTD WordPress plugin through 1.2.2 is lacking any CSRF check when updating its settings, allowing attackers to make logged in administrators change them to arbitrary values.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed

Vendors

Shantz Wordpress Qotd Project

Products

Shantz Wordpress Qotd

CVE-2021-24349

Gallery From Files <= 1.6.0 - Reflected Cross-Site Scripting (XSS)

This Gallery from files WordPress plugin through 1.6.0 gives the functionality of uploading images to the server. But filenames are not properly sanitized before being output in an error message when they have an invalid extension, leading to a reflected Cross-Site Scripting issue. Due to the lack of CSRF check, the attack could also be performed via such vector.

CVSS 3.1 · 6.1 Medium EPSS < 1% KEV · Not listed

Vendors

Gallery From Files Project

Products

Gallery From Files