Export limit exceeded: 425866 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.

Export limit exceeded: 10004 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.

Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 10,004

Export CSV
CVE-2021-24795

Filter Portfolio Gallery <= 1.5 - Arbitrary Gallery Deletion via CSRF

The Filter Portfolio Gallery WordPress plugin through 1.5 is lacking Cross-Site Request Forgery (CSRF) check when deleting a Gallery, which could allow attackers to make a logged in admin delete arbitrary Gallery.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Phoeniixx
Products
Filter Portfolio Gallery
CVE-2021-24790

Contact Form Advanced Database <= 1.0.8 - Unauthorised AJAX Calls

The Contact Form Advanced Database WordPress plugin through 1.0.8 does not have any authorisation as well as CSRF checks in its delete_cf7_data and export_cf7_data AJAX actions, available to any authenticated users, which could allow users with a role as low as subscriber to call them. The delete_cf7_data would lead to arbitrary metadata deletion, as well as PHP Object Injection if a suitable gadget chain is present in another plugin, as user data is passed to the maybe_unserialize() function without being first validated.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed
Vendors
Contact Form Advanced Database Project
Products
Contact Form Advanced Database
CVE-2021-24784

WP Admin Logo Changer <= 1.0 - Plugin's Settings Update via CSRF

The WP Admin Logo Changer WordPress plugin through 1.0 does not have CSRF check when saving its settings, which could allow attackers to make a logged in admin update them via a CSRF attack.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Wp Admin Logo Changer Project
Products
Wp Admin Logo Changer
CVE-2021-24780

Single Post Exporter <= 1.1.1 - Plugin's Settings Update via CSRF

The Single Post Exporter WordPress plugin through 1.1.1 does not have CSRF checks when saving its settings, which could allow attackers to make a logged in admin change them via a CSRF attack and give access to the export feature to any role such as subscriber. Subscriber users would then be able to export an arbitrary post/page (such as private and password protected) via a direct URL

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed
Vendors
Single Post Exporter Project
Products
Single Post Exporter
CVE-2021-24779

WP Debugging < 2.11.0 - Unauthenticated Plugin's Settings Update

The WP Debugging WordPress plugin before 2.11.0 has its update_settings() function hooked to admin_init and is missing any authorisation and CSRF checks, as a result, the settings can be updated by unauthenticated users.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Wp Debugging Project
Products
Wp Debugging
CVE-2021-24766

404 to 301 < 3.0.9 - Logs Deletion via CSRF

The 404 to 301 – Redirect, Log and Notify 404 Errors WordPress plugin before 3.0.9 does not have CSRF check in place when cleaning the logs, which could allow attacker to make a logged in admin delete all of them via a CSRF attack

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
404 To 301 Project
Products
404 To 301
CVE-2021-24763

Perfect Survey < 1.5.2 - Unauthorised AJAX Call to Stored XSS / Survey Settings Update

The Perfect Survey WordPress plugin before 1.5.2 does not have proper authorisation nor CSRF checks in the save_global_setting AJAX action, allowing unauthenticated users to edit surveys and modify settings. Given the lack of sanitisation and escaping in the settings, this could also lead to a Stored Cross-Site Scripting issue which will be executed in the context of a user viewing any survey

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed
Vendors
Getperfectsurvey
Products
Perfect Survey
CVE-2021-24761

Error Log Viewer < 1.1.2 - Arbitrary Text File Deletion via CSRF

The Error Log Viewer WordPress plugin before 1.1.2 does not perform nonce check when deleting a log file and does not have path traversal prevention, which could allow attackers to make a logged in admin delete arbitrary text files on the web server.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Bestwebsoft
Products
Error Log Viewer
CVE-2021-24752

Multiple Plugins from CatchThemes - Unauthorised Plugin's Setting Change

Multiple Plugins from the CatchThemes vendor do not perform capability and CSRF checks in the ctp_switch AJAX action, which could allow any authenticated users, such as Subscriber to change the Essential Widgets WordPress plugin before 1.9, To Top WordPress plugin before 2.3, Header Enhancement WordPress plugin before 1.5, Generate Child Theme WordPress plugin before 1.6, Essential Content Types WordPress plugin before 1.9, Catch Web Tools WordPress plugin before 2.7, Catch Under Construction WordPress plugin before 1.4, Catch Themes Demo Import WordPress plugin before 1.6, Catch Sticky Menu WordPress plugin before 1.7, Catch Scroll Progress Bar WordPress plugin before 1.6, Social Gallery and Widget WordPress plugin before 2.3, Catch Infinite Scroll WordPress plugin before 1.9, Catch Import Export WordPress plugin before 1.9, Catch Gallery WordPress plugin before 1.7, Catch Duplicate Switcher WordPress plugin before 1.6, Catch Breadcrumb WordPress plugin before 1.7, Catch IDs WordPress plugin before 2.4's configurations.

CVSS 3.1 · 5.7 Medium EPSS < 1% KEV · Not listed
Vendors
Catchplugins
Products
Catch Scroll Progress Bar Catch Sticky Menu Catch Themes Demo Import and 7 more
CVE-2021-24735

Compact WP Audio Player < 1.9.7 - Setting Change via CSRF

The Compact WP Audio Player WordPress plugin before 1.9.7 does not implement nonce checks, which could allow attackers to make a logged in admin change the "Disable Simultaneous Play" setting via a CSRF attack.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Tipsandtricks-hq
Products
Compact Wp Audio Player
CVE-2021-24730

Logo Showcase with Slick Slider < 1.2.5 - Subscriber+ Arbitrary Media Title/Description/Alt Text/URL Update

The Logo Showcase with Slick Slider WordPress plugin before 1.2.5 does not have CSRF and authorisation checks in the lswss_save_attachment_data AJAX action, allowing any authenticated users, such as Subscriber, to change title, description, alt text, and URL of arbitrary uploaded media.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed
Vendors
Infornweb
Products
Logo Showcase With Slick Slider
CVE-2021-24725

Comment Link Remove and Other Comment Tools < 2.1.6 - Arbitrary Comment Deletion via CSRF

The Comment Link Remove and Other Comment Tools WordPress plugin before 2.1.6 does not have CSRF check in its 'Delete comments easily', which could allow attackers to make logged in admin delete arbitrary comments

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed
Vendors
Quantumcloud
Products
Comment Link Remove And Other Comment Tools
CVE-2021-24711

Software License Manager < 4.5.1 - Arbitrary Domain Deletion via CSRF

The del_reistered_domains AJAX action of the Software License Manager WordPress plugin before 4.5.1 does not have any CSRF checks, and is vulnerable to a CSRF attack

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed
Vendors
Tipsandtricks-hq
Products
Software License Manager
CVE-2021-24704

Orange Form <= 1.0 - SQL Injection via CSRF

In the Orange Form WordPress plugin through 1.0, the process_bulk_action() function in "admin/orange-form-email.php" performs an unprepared SQL query with an unsanitized parameter ($id). Only admin can access the page that invokes the function, but because of lack of CSRF protection, it is actually exploitable and could allow attackers to make a logged in admin delete arbitrary posts for example

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed
Vendors
Orange-form Project
Products
Orange-form
CVE-2021-24703

Download Plugin < 1.6.1 - Subscriber+ Arbitrary Plugin Activation

The Download Plugin WordPress plugin before 1.6.1 does not have capability and CSRF checks in the dpwap_plugin_activate AJAX action, allowing any authenticated users, such as subscribers, to activate plugins that are already installed.

CVSS 3.1 · 5.7 Medium EPSS < 1% KEV · Not listed
Vendors
Metagauss
Products
Download Plugin
CVE-2021-24696

Simple Download Monitor < 3.9.9 - Multiple CSRF

The Simple Download Monitor WordPress plugin before 3.9.9 does not enforce nonce checks, which could allow attackers to perform CSRF attacks to 1) make admins export logs to exploit a separate log disclosure vulnerability (fixed in 3.9.6), 2) delete logs (fixed in 3.9.9), 3) remove thumbnail image from downloads

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed
Vendors
Tipsandtricks-hq
Products
Simple Download Monitor
CVE-2021-24688

Orange Form <= 1.0.1 - Unauthenticated Arbitrary Post Deletion

The Orange Form WordPress plugin through 1.0.1 does not have any authorisation and CSRF checks in all of its AJAX calls, for example the or_delete_filed one which is available to both unauthenticated and authenticated users could allow attackers to delete arbitrary posts.The AJAX calls performing actions on posts also do not ensure that the post belong to them (or that they are allowed to perform such action on it)

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed
Vendors
Orange-form Project
Products
Orange-form
CVE-2021-24685

Flat Preloader < 1.5.4 - CSRF to Stored Cross-Site Scripting

The Flat Preloader WordPress plugin before 1.5.4 does not enforce nonce checks when saving its settings, as well as does not sanitise and escape them, which could allow attackers to a make logged in admin change them with a Cross-Site Scripting payload (triggered either in the frontend or backend depending on the payload)

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed
Vendors
Flat Preloader Project
Products
Flat Preloader
CVE-2021-24683

Weather Effect < 1.3.4 - CSRF to Stored Cross-Site Scripting

The Weather Effect WordPress plugin before 1.3.4 does not have any CSRF checks in place when saving its settings, and do not validate or escape them, which could lead to Stored Cross-Site Scripting issue.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed
Vendors
Awplife
Products
Weather Effect