CVE-2021-24717

AutomatorWP < 1.7.6 - Missing Authorization and Privilege Escalation

The AutomatorWP WordPress plugin before 1.7.6 does not perform capability checks which allows users with Subscriber roles to enumerate automations, disclose title of private posts or user emails, call functions, or perform privilege escalation via Ajax actions.

CVSS 3.1 · 8.8 High EPSS 1.3% KEV · Not listed

Vendors

Automatorwp

Products

Automatorwp

CVE-2021-24677

Find My Blocks < 3.4.0 - Private Post Titles Disclosure

The Find My Blocks WordPress plugin before 3.4.0 does not have authorisation checks in its REST API, which could allow unauthenticated users to enumerate private posts' titles.

CVSS 3.1 · 5.3 Medium EPSS 1.3% KEV · Not listed

Vendors

Find My Blocks Project

Products

Find My Blocks

CVE-2021-24652

PostX Gutenberg Blocks for Post Grid < 2.4.10 - Missing Access Controls

The PostX – Gutenberg Blocks for Post Grid WordPress plugin before 2.4.10 performs incorrect checks before allowing any logged in user to perform some ajax based requests, allowing any user to modify, delete or add ultp_options values.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Wpxpo

Products

Postx - Gutenberg Blocks For Post Grid

CVE-2021-24639

OMGF < 4.5.4 - Subscriber+ Arbitrary File/Folder Deletion

The OMGF WordPress plugin before 4.5.4 does not enforce path validation, authorisation and CSRF checks in the omgf_ajax_empty_dir AJAX action, which allows any authenticated users to delete arbitrary files or folders on the server.

CVSS 3.1 · 8.1 High EPSS < 1% KEV · Not listed

Vendors

Ffw

Products

Omgf

CVE-2021-24635

Visual Link Preview < 2.2.3 - Unauthorised AJAX Calls

The Visual Link Preview WordPress plugin before 2.2.3 does not enforce authorisation on several AJAX actions and has the CSRF nonce displayed for all authenticated users, allowing any authenticated user (such as subscriber) to call them and 1) Get and search through title and content of Draft post, 2) Get title of a password-protected post as well as 3) Upload an image from an URL

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed

Vendors

Bootstrapped

Products

Visual Link Preview

CVE-2021-24633

Countdown Block < 1.1.2 - Missing Authorisation in AJAX action

The Countdown Block WordPress plugin before 1.1.2 does not have authorisation in the eb_write_block_css AJAX action, which allows any authenticated user, such as Subscriber, to modify post contents displayed to users.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed

Vendors

Wpdeveloper

Products

Countdown Block

CVE-2021-24501

Workreap theme < 2.2.2 - Missing Authorization Checks in Ajax Actions

The Workreap WordPress theme before 2.2.2 had several AJAX actions missing authorization checks to verify that a user was authorized to perform critical operations such as modifying or deleting objects. This allowed a logged in user to modify or delete objects belonging to other users on the site.

CVSS 3.1 · 8.1 High EPSS 1.3% KEV · Not listed

Vendors

Amentotech

Products

Workreap

CVE-2021-24500

Workreap theme < 2.2.2 - Multiple CSRF + IDOR Vulnerabilities

Several AJAX actions available in the Workreap WordPress theme before 2.2.2 lacked CSRF protections, as well as allowing insecure direct object references that were not validated. This allows an attacker to trick a logged in user to submit a POST request to the vulnerable site, potentially modifying or deleting arbitrary objects on the target site.

CVSS 3.1 · 8.1 High EPSS < 1% KEV · Not listed

Vendors

Amentotech

Products

Workreap

CVE-2021-24405

Easy Cookie Policy <= 1.6.2 - Broken Access Control to Stored Cross-Site Scripting

The Easy Cookies Policy WordPress plugin through 1.6.2 is lacking any capability and CSRF check when saving its settings, allowing any authenticated users (such as subscriber) to change them. If users can't register, this can be done through CSRF. Furthermore, the cookie banner setting is not sanitised or validated before being output in all pages of the frontend and the backend settings one, leading to a Stored Cross-Site Scripting issue.

CVSS 3.1 · 6.5 Medium EPSS 10.7% KEV · Not listed

Vendors

Izsoft

Products

Easy Cookies Policy

CVE-2021-24379

Comments Like Dislike < 1.1.4 - Add Like/Dislike Bypass

The Comments Like Dislike WordPress plugin before 1.1.4 allows users to like/dislike posted comments, however does not prevent them from replaying the AJAX request to add a like. This allows any user (even unauthenticated) to add unlimited like/dislike to any comment. The plugin appears to have some Restriction modes, such as Cookie Restriction, IP Restrictions, Logged In User Restriction, however, they do not prevent such attack as they only check client side

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Wphappycoders

Products

Comments Like Dislike

CVE-2021-24356

Simple 301 Redirects by BetterLinks - 2.0.0 – 2.0.3 - Arbitrary Plugin Activation

In the Simple 301 Redirects by BetterLinks WordPress plugin before 2.0.4, a lack of capability checks and insufficient nonce check on the AJAX action, simple301redirects/admin/activate_plugin, made it possible for authenticated users to activate arbitrary plugins installed on vulnerable sites.

CVSS 3.1 · 8.8 High EPSS 2.6% KEV · Not listed

Vendors

Wpdeveloper

Products

Simple 301 Redirects

CVE-2021-24355

Simple 301 Redirects by BetterLinks - 2.0.0 – 2.0.3 - Update and Retrieve Wildcard Value

In the Simple 301 Redirects by BetterLinks WordPress plugin before 2.0.4, the lack of capability checks and insufficient nonce check on the AJAX actions, simple301redirects/admin/get_wildcard and simple301redirects/admin/wildcard, made it possible for authenticated users to retrieve and update the wildcard value for redirects.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed

Vendors

Wpdeveloper

Products

Simple 301 Redirects

CVE-2021-24354

Simple 301 Redirects by BetterLinks - 2.0.0-2.0.3 - Arbitrary Plugin Installation

A lack of capability checks and insufficient nonce check on the AJAX action in the Simple 301 Redirects by BetterLinks WordPress plugin before 2.0.4, made it possible for authenticated users to install arbitrary plugins on vulnerable sites.

CVSS 3.1 · 8.8 High EPSS 1.5% KEV · Not listed

Vendors

Wpdeveloper

Products

Simple 301 Redirects

CVE-2021-24353

Simple 301 Redirects by BetterLinks - 2.0.0 – 2.0.3 - Unauthenticated Redirect Import

The import_data function of the Simple 301 Redirects by BetterLinks WordPress plugin before 2.0.4 had no capability or nonce checks making it possible for unauthenticated users to import a set of site redirects.

CVSS 3.1 · 8.8 High EPSS 1.5% KEV · Not listed

Vendors

Wpdeveloper

Products

Simple 301 Redirects

CVE-2021-24352

Simple 301 Redirects by BetterLinks - 2.0.0 – 2.0.3 - Unauthenticated Redirect Export

The export_data function of the Simple 301 Redirects by BetterLinks WordPress plugin before 2.0.4 had no capability or nonce checks making it possible for unauthenticated users to export a site's redirects.

CVSS 3.1 · 8.8 High EPSS 1.2% KEV · Not listed

Vendors

Wpdeveloper

Products

Simple 301 Redirects

CVE-2021-24282

Redirection for Contact Form 7 < 2.3.4 - Unprotected AJAX Actions

In the Redirection for Contact Form 7 WordPress plugin before 2.3.4, any authenticated user, such as a subscriber, could use the various AJAX actions in the plugin to do a variety of things. For example, an attacker could use wpcf7r_reset_settings to reset the plugin’s settings, wpcf7r_add_action to add actions to a form, and more.

CVSS 3.1 · 6.3 Medium EPSS < 1% KEV · Not listed

Vendors

Querysol

Products

Redirection For Contact Form 7

CVE-2021-24281

Redirection for Contact Form 7 < 2.3.4 - Authenticated Arbitrary Post Deletion

In the Redirection for Contact Form 7 WordPress plugin before 2.3.4, any authenticated user, such as a subscriber, could use the delete_action_post AJAX action to delete any post on a target site.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed

Vendors

Querysol

Products

Redirection For Contact Form 7

CVE-2021-24279

Redirection for Contact Form 7 < 2.3.4 - Authenticated Arbitrary Plugin Installation

In the Redirection for Contact Form 7 WordPress plugin before 2.3.4, low level users, such as subscribers, could use the import_from_debug AJAX action to install any plugin from the WordPress repository.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Querysol

Products

Redirection For Contact Form 7

CVE-2021-24278

Redirection for Contact Form 7 < 2.3.4 - Unauthenticated Arbitrary Nonce Generation

In the Redirection for Contact Form 7 WordPress plugin before 2.3.4, unauthenticated users can use the wpcf7r_get_nonce AJAX action to retrieve a valid nonce for any WordPress action/function.

CVSS 3.1 · 7.5 High EPSS 7.4% KEV · Not listed

Vendors

Querysol

Products

Redirection For Contact Form 7

CVE-2021-24244

WPBakery Page Builder Clipboard < 4.5.8 - Unauthorised Arbitrary License Options Update

An AJAX action registered by the WPBakery Page Builder (Visual Composer) Clipboard WordPress plugin before 4.5.8 did not have capability checks, allowing low privilege users, such as subscribers, to update the license options (key, email).

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Wpbakery Page Builder Clipboard Project

Products

Wpbakery Page Builder Clipboard