Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 12,015

Export CSV
CVE-2021-24950

Insight Core <= 1.0 - Subscriber+ PHP Object Injection & Stored XSS

The Insight Core WordPress plugin through 1.0 does not have any authorisation and CSRF checks in the insight_customizer_options_import (available to any authenticated user), does not validate user input before passing it to unserialize(), nor sanitise and escape it before outputting it in the response. As a result, it could allow users with a role as low as Subscriber to perform PHP Object Injection, as well as Stored Cross-Site Scripting attacks

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed
Vendors
Thememove
Products
Insight Core
CVE-2021-24914

Tawk.to Live Chat < 0.6.0 - Subscriber+ Visitor Monitoring & Chat Removal

The Tawk.To Live Chat WordPress plugin before 0.6.0 does not have capability and CSRF checks in the tawkto_setwidget and tawkto_removewidget AJAX actions, available to any authenticated user. The first one allows low-privileged users (including simple subscribers) to change the 'tawkto-embed-widget-page-id' and 'tawkto-embed-widget-widget-id' parameters. Any authenticated user can thus link the vulnerable website to their own Tawk.to instance. Consequently, they will be able to monitor the vulnerable website and interact with its visitors (receive contact messages, answer, ...). They will also be able to display an arbitrary Knowledge Base. The second one will remove the live chat widget from pages.

CVSS 3.1 · 8.0 High EPSS < 1% KEV · Not listed
Vendors
Tawk
Products
Tawk.to Live Chat
CVE-2021-24906

Protect WP Admin < 3.6.2 - Unauthenticated Plugin Deactivation

The Protect WP Admin WordPress plugin before 3.6.2 does not check for authorisation in the lib/pwa-deactivate.php file, which could allow unauthenticated users to disable the plugin (and therefore the protection offered) via a crafted request

CVSS 3.1 · 7.5 High EPSS 1.5% KEV · Not listed
Vendors
Wp-experts
Products
Protect Wp Admin
CVE-2021-24851

Insert Pages < 3.7.0 - Contributor+ Arbitrary Posts/Pages Access

The Insert Pages WordPress plugin before 3.7.0 allows users with a role as low as Contributor to access content and metadata from arbitrary posts/pages regardless of their author and status (ie private), using a shortcode. Password protected posts/pages are not affected by such issue.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed
Vendors
Insert Pages Project
Products
Insert Pages
CVE-2021-24842

Bulk Datetime Change < 1.12 - Missing Authorisation

The Bulk Datetime Change WordPress plugin before 1.12 does not enforce capability checks which allows users with Contributor roles to 1) list private post titles of other users and 2) change the posted date of other users' posts.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed
Vendors
Bulk Datetime Change Project
Products
Bulk Datetime Change
CVE-2021-24839

SupportCandy < 2.2.5 - Unauthenticated Arbitrary Ticket Deletion

The SupportCandy WordPress plugin before 2.2.5 does not have authorisation and CSRF checks in its wpsc_tickets AJAX action, which could allow unauthenticated users to call it and delete arbitrary tickets via the set_delete_permanently_bulk_ticket setting_action. Other actions may be affected as well.

CVSS 3.1 · 7.5 High EPSS 1.2% KEV · Not listed
Vendors
Supportcandy
Products
Supportcandy
CVE-2021-24836

Temporary Login Without Password < 1.7.1 - Subscriber+ Plugin's Settings Update

The Temporary Login Without Password WordPress plugin before 1.7.1 does not have authorisation and CSRF checks when updating its settings, which could allows any logged-in users, such as subscribers to update them

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed
Vendors
Storeapps
Products
Temporary Login Without Password
CVE-2021-24831

Tab - Accordion, FAQ < 1.3.2 - Unauthenticated AJAX Calls

All AJAX actions of the Tab WordPress plugin before 1.3.2 are available to both unauthenticated and authenticated users, allowing unauthenticated attackers to modify various data in the plugin, such as add/edit/delete arbitrary tabs.

CVSS 3.1 · 7.5 High EPSS 1.2% KEV · Not listed
Vendors
Rich-web
Products
Tab
CVE-2021-24790

Contact Form Advanced Database <= 1.0.8 - Unauthorised AJAX Calls

The Contact Form Advanced Database WordPress plugin through 1.0.8 does not have any authorisation as well as CSRF checks in its delete_cf7_data and export_cf7_data AJAX actions, available to any authenticated users, which could allow users with a role as low as subscriber to call them. The delete_cf7_data would lead to arbitrary metadata deletion, as well as PHP Object Injection if a suitable gadget chain is present in another plugin, as user data is passed to the maybe_unserialize() function without being first validated.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed
Vendors
Contact Form Advanced Database Project
Products
Contact Form Advanced Database
CVE-2021-24779

WP Debugging < 2.11.0 - Unauthenticated Plugin's Settings Update

The WP Debugging WordPress plugin before 2.11.0 has its update_settings() function hooked to admin_init and is missing any authorisation and CSRF checks, as a result, the settings can be updated by unauthenticated users.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Wp Debugging Project
Products
Wp Debugging
CVE-2021-24730

Logo Showcase with Slick Slider < 1.2.5 - Subscriber+ Arbitrary Media Title/Description/Alt Text/URL Update

The Logo Showcase with Slick Slider WordPress plugin before 1.2.5 does not have CSRF and authorisation checks in the lswss_save_attachment_data AJAX action, allowing any authenticated users, such as Subscriber, to change title, description, alt text, and URL of arbitrary uploaded media.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed
Vendors
Infornweb
Products
Logo Showcase With Slick Slider
CVE-2021-24677

Find My Blocks < 3.4.0 - Private Post Titles Disclosure

The Find My Blocks WordPress plugin before 3.4.0 does not have authorisation checks in its REST API, which could allow unauthenticated users to enumerate private posts' titles.

CVSS 3.1 · 5.3 Medium EPSS 1.3% KEV · Not listed
Vendors
Find My Blocks Project
Products
Find My Blocks
CVE-2021-24639

OMGF < 4.5.4 - Subscriber+ Arbitrary File/Folder Deletion

The OMGF WordPress plugin before 4.5.4 does not enforce path validation, authorisation and CSRF checks in the omgf_ajax_empty_dir AJAX action, which allows any authenticated users to delete arbitrary files or folders on the server.

CVSS 3.1 · 8.1 High EPSS < 1% KEV · Not listed
Vendors
Ffw
Products
Omgf
CVE-2021-24635

Visual Link Preview < 2.2.3 - Unauthorised AJAX Calls

The Visual Link Preview WordPress plugin before 2.2.3 does not enforce authorisation on several AJAX actions and has the CSRF nonce displayed for all authenticated users, allowing any authenticated user (such as subscriber) to call them and 1) Get and search through title and content of Draft post, 2) Get title of a password-protected post as well as 3) Upload an image from an URL

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed
Vendors
Bootstrapped
Products
Visual Link Preview
CVE-2021-24633

Countdown Block < 1.1.2 - Missing Authorisation in AJAX action

The Countdown Block WordPress plugin before 1.1.2 does not have authorisation in the eb_write_block_css AJAX action, which allows any authenticated user, such as Subscriber, to modify post contents displayed to users.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed
Vendors
Wpdeveloper
Products
Countdown Block
CVE-2021-24501

Workreap theme < 2.2.2 - Missing Authorization Checks in Ajax Actions

The Workreap WordPress theme before 2.2.2 had several AJAX actions missing authorization checks to verify that a user was authorized to perform critical operations such as modifying or deleting objects. This allowed a logged in user to modify or delete objects belonging to other users on the site.

CVSS 3.1 · 8.1 High EPSS 1.3% KEV · Not listed
Vendors
Amentotech
Products
Workreap
CVE-2021-24500

Workreap theme < 2.2.2 - Multiple CSRF + IDOR Vulnerabilities

Several AJAX actions available in the Workreap WordPress theme before 2.2.2 lacked CSRF protections, as well as allowing insecure direct object references that were not validated. This allows an attacker to trick a logged in user to submit a POST request to the vulnerable site, potentially modifying or deleting arbitrary objects on the target site.

CVSS 3.1 · 8.1 High EPSS < 1% KEV · Not listed
Vendors
Amentotech
Products
Workreap
CVE-2021-24356

Simple 301 Redirects by BetterLinks - 2.0.0 – 2.0.3 - Arbitrary Plugin Activation

In the Simple 301 Redirects by BetterLinks WordPress plugin before 2.0.4, a lack of capability checks and insufficient nonce check on the AJAX action, simple301redirects/admin/activate_plugin, made it possible for authenticated users to activate arbitrary plugins installed on vulnerable sites.

CVSS 3.1 · 8.8 High EPSS 2.6% KEV · Not listed
Vendors
Wpdeveloper
Products
Simple 301 Redirects
CVE-2021-24355

Simple 301 Redirects by BetterLinks - 2.0.0 – 2.0.3 - Update and Retrieve Wildcard Value

In the Simple 301 Redirects by BetterLinks WordPress plugin before 2.0.4, the lack of capability checks and insufficient nonce check on the AJAX actions, simple301redirects/admin/get_wildcard and simple301redirects/admin/wildcard, made it possible for authenticated users to retrieve and update the wildcard value for redirects.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed
Vendors
Wpdeveloper
Products
Simple 301 Redirects
CVE-2021-24354

Simple 301 Redirects by BetterLinks - 2.0.0-2.0.3 - Arbitrary Plugin Installation

A lack of capability checks and insufficient nonce check on the AJAX action in the Simple 301 Redirects by BetterLinks WordPress plugin before 2.0.4, made it possible for authenticated users to install arbitrary plugins on vulnerable sites.

CVSS 3.1 · 8.8 High EPSS 1.5% KEV · Not listed
Vendors
Wpdeveloper
Products
Simple 301 Redirects