CVE-2021-24675

One User Avatar < 2.3.7 - Avatar Update via CSRF

The One User Avatar WordPress plugin before 2.3.7 does not check for CSRF when updating the Avatar in page where the [avatar_upload] shortcode is embed. As a result, attackers could make logged in user change their avatar via a CSRF attack

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Onedesigns

Products

One User Avatar

CVE-2021-24674

Genie WP Favicon <= 0.5.2 - Arbitrary Favicon Change via CSRF

The Genie WP Favicon WordPress plugin through 0.5.2 does not have CSRF in place when updating the favicon, which could allow attackers to make a logged in admin change it via a CSRF attack

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Genie Wp Favicon Project

Products

Genie Wp Favicon

CVE-2021-24668

MAZ Loader < 1.4.1 - Arbitrary Loader Deletion via CSRF

The MAZ Loader WordPress plugin before 1.4.1 does not enforce nonce checks, which allows attackers to make administrators delete arbitrary loaders via a CSRF attack

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed

Vendors

Feataholic

Products

Maz Loader

CVE-2021-24642

Scroll Baner <= 1.0 - CSRF to RCE

The Scroll Baner WordPress plugin through 1.0 does not have CSRF check in place when saving its settings, nor perform any sanitisation, escaping or validation on them. This could allow attackers to make logged in admin change them and could lead to RCE (via a file upload) as well as XSS

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Scroll Banner Project

Products

Scroll Banner

CVE-2021-24641

Images to WebP < 1.9 - Multiple Cross Site Request Forgery (CSRF)

The Images to WebP WordPress plugin before 1.9 does not have CSRF checks in place when performing some administrative actions, which could result in modification of plugin settings, Denial-of-Service, as well as arbitrary image conversion

CVSS 3.1 · 8.1 High EPSS < 1% KEV · Not listed

Vendors

Imagestowebp Project

Products

Images To Webp

CVE-2021-24639

OMGF < 4.5.4 - Subscriber+ Arbitrary File/Folder Deletion

The OMGF WordPress plugin before 4.5.4 does not enforce path validation, authorisation and CSRF checks in the omgf_ajax_empty_dir AJAX action, which allows any authenticated users to delete arbitrary files or folders on the server.

CVSS 3.1 · 8.1 High EPSS < 1% KEV · Not listed

Vendors

Ffw

Products

Omgf

CVE-2021-24636

Print My Blog < 3.4.2 - Plugin Deactivation via CSRF

The Print My Blog WordPress Plugin before 3.4.2 does not enforce nonce (CSRF) checks, which allows attackers to make logged in administrators deactivate the Print My Blog plugin and delete all saved data for that plugin by tricking them to open a malicious link

CVSS 3.1 · 8.1 High EPSS < 1% KEV · Not listed

Vendors

Print My Blog Project

Products

Print My Blog

CVE-2021-24626

Chameleon CSS <= 1.2 - Subscriber+ SQL Injection

The Chameleon CSS WordPress plugin through 1.2 does not have any CSRF and capability checks in all its AJAX calls, allowing any authenticated user, such as subscriber to call them and perform unauthorised actions. One of AJAX call, remove_css, also does not sanitise or escape the css_id POST parameter before using it in a SQL statement, leading to a SQL Injection

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

Chameleon Css Project

Products

Chameleon Css

CVE-2021-24620

Simple eCommerce <= 2.2.5 - Arbitrary File Upload

The WordPress Simple Ecommerce Shopping Cart Plugin- Sell products through Paypal plugin through 2.2.5 does not check for the uploaded Downloadable Digital product file, allowing any file, such as PHP to be uploaded by an administrator. Furthermore, as there is no CSRF in place, attackers could also make a logged admin upload a malicious PHP file, which would lead to RCE

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

Simple-e-commerce-shopping-cart Project

Products

Simple-e-commerce-shopping-cart

CVE-2021-24618

Donate With QRCode < 1.4.5 - Stored Cross-Site Scripting

The Donate With QRCode WordPress plugin before 1.4.5 does not sanitise or escape its QRCode Image setting, which result into a Stored Cross-Site Scripting (XSS). Furthermore, the plugin also does not have any CSRF and capability checks in place when saving such setting, allowing any authenticated user (as low as subscriber), or unauthenticated user via a CSRF vector to update them and perform such attack.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed

Vendors

Wbolt

Products

Donate With Qrcode

CVE-2021-24615

Wechat Reward <= 1.7 - CSRF to Stored Cross-Site Scripting

The Wechat Reward WordPress plugin through 1.7 does not sanitise or escape its QR settings, nor has any CSRF check in place, allowing attackers to make a logged in admin change the settings and perform Cross-Site Scripting attacks.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed

Vendors

Wechat Reward Project

Products

Wechat Reward

CVE-2021-24611

Keywords & Meta <= 3.0 - CSRF to Stored Cross-Site Scripting (XSS)

The Keyword Meta WordPress plugin through 3.0 does not sanitise of escape its settings before outputting them back in the page after they are saved, allowing for Cross-Site Scripting issues. Furthermore, it is also lacking any CSRF check, allowing attacker to make a logged in high privilege user save arbitrary setting via a CSRF attack.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed

Vendors

Keyword Meta Project

Products

Keyword Meta

CVE-2021-24595

WP Cookie Choice <= 1.1.0 - CSRF to Stored Cross-Site Scripting

The Wp Cookie Choice WordPress plugin through 1.1.0 is lacking any CSRF check when saving its options, and do not escape them when outputting them in attributes. As a result, an attacker could make a logged in admin change them to arbitrary values including XSS payloads via a CSRF attack.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Wp Cookie Choice Project

Products

Wp Cookie Choice

CVE-2021-24586

Per Page Add to Head < 1.4.4 - CSRF to Stored XSS

The Per page add to head WordPress plugin before 1.4.4 is lacking any CSRF check when saving its settings, which could allow attackers to make a logged in admin change them. Furthermore, as the plugin allows arbitrary HTML to be inserted in one of the setting (feature mentioned by the plugin), this could lead to Stored XSS issue which will be triggered either in the backend, frontend or both depending on the payload used.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed

Vendors

Evona

Products

Per Page Add To Head

CVE-2021-24584

Timetable and Event Schedule by MotoPress < 2.4.2 - Unauthorised Event TimeSlot Update

The Timetable and Event Schedule WordPress plugin before 2.4.2 does not have proper access control when updating a timeslot, allowing any user with the edit_posts capability (contributor+) to update arbitrary timeslot from any events. Furthermore, no CSRF check is in place as well, allowing such attack to be perform via CSRF against a logged in with such capability. In versions before 2.3.19, the lack of sanitisation and escaping in some of the fields, like the descritption could also lead to Stored XSS issues

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed

Vendors

Motopress

Products

Timetable And Event Schedule

CVE-2021-24583

Timetable and Event Schedule by MotoPress < 2.4.2 - Unauthorised Event TimeSlot Deletion

The Timetable and Event Schedule WordPress plugin before 2.4.2 does not have proper access control when deleting a timeslot, allowing any user with the edit_posts capability (contributor+) to delete arbitrary timeslot from any events. Furthermore, no CSRF check is in place as well, allowing such attack to be performed via CSRF against a logged in with such capability

CVSS 3.1 · 4.3 Medium EPSS 1.6% KEV · Not listed

Vendors

Motopress

Products

Timetable And Event Schedule

CVE-2021-24581

Blue Admin <= 21.06.01 - CSRF to Stored Cross-Site Scripting (XSS)

The Blue Admin WordPress plugin through 21.06.01 does not sanitise or escape its "Logo Title" setting before outputting in a page, leading to a Stored Cross-Site Scripting issue. Furthermore, the plugin does not have CSRF check in place when saving its settings, allowing the issue to be exploited via a CSRF attack.

CVSS 3.1 · 8.8 High EPSS 4.1% KEV · Not listed

Vendors

Blue-admin Project

Products

Blue-admin

CVE-2021-24572

Paypal Donation < 1.3.1 - CSRF to Arbitrary Post Deletion

The Accept Donations with PayPal WordPress plugin before 1.3.1 provides a function to create donation buttons which are internally stored as posts. The deletion of a button is not CSRF protected and there is no control to check if the deleted post was a button post. As a result, an attacker could make logged in admins delete arbitrary posts

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed

Vendors

Wpplugin

Products

Accept Donations With Paypal

CVE-2021-24570

Paypal Donation < 1.3.1 - CSRF to Stored Cross-Site Scripting

The Accept Donations with PayPal WordPress plugin before 1.3.1 offers a function to create donation buttons, which internally are posts. The process to create a new button is lacking a CSRF check. An attacker could use this to make an authenticated admin create a new button. Furthermore, one of the Button field is not escaped before being output in an attribute when editing a Button, leading to a Stored Cross-Site Scripting issue as well.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed

Vendors

Wpplugin

Products

Accept Donations With Paypal

CVE-2021-24565

Contact Form 7 Captcha < 0.0.9 - CSRF to Stored XSS

The Contact Form 7 Captcha WordPress plugin before 0.0.9 does not have any CSRF check in place when saving its settings, allowing attacker to make a logged in user with the manage_options change them. Furthermore, the settings are not escaped when output in attributes, leading to a Stored Cross-Site Scripting issue.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

Contact Form 7 Captcha Project

Products

Contact Form 7 Captcha