Export limit exceeded: 16981 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.

Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 16,981

Export CSV
CVE-2021-24917

WPS Hide Login < 1.9.1 - Protection Bypass with Referer-Header

The WPS Hide Login WordPress plugin before 1.9.1 has a bug which allows to get the secret login page by setting a random referer string and making a request to /wp-admin/options.php as an unauthenticated user.

CVSS 3.1 · 7.5 High EPSS 72.2% KEV · Not listed
Vendors
Wpserveur
Products
Wps Hide Login
CVE-2021-24914

Tawk.to Live Chat < 0.6.0 - Subscriber+ Visitor Monitoring & Chat Removal

The Tawk.To Live Chat WordPress plugin before 0.6.0 does not have capability and CSRF checks in the tawkto_setwidget and tawkto_removewidget AJAX actions, available to any authenticated user. The first one allows low-privileged users (including simple subscribers) to change the 'tawkto-embed-widget-page-id' and 'tawkto-embed-widget-widget-id' parameters. Any authenticated user can thus link the vulnerable website to their own Tawk.to instance. Consequently, they will be able to monitor the vulnerable website and interact with its visitors (receive contact messages, answer, ...). They will also be able to display an arbitrary Knowledge Base. The second one will remove the live chat widget from pages.

CVSS 3.1 · 8.0 High EPSS < 1% KEV · Not listed
Vendors
Tawk
Products
Tawk.to Live Chat
CVE-2021-24906

Protect WP Admin < 3.6.2 - Unauthenticated Plugin Deactivation

The Protect WP Admin WordPress plugin before 3.6.2 does not check for authorisation in the lib/pwa-deactivate.php file, which could allow unauthenticated users to disable the plugin (and therefore the protection offered) via a crafted request

CVSS 3.1 · 7.5 High EPSS 1.5% KEV · Not listed
Vendors
Wp-experts
Products
Protect Wp Admin
CVE-2021-24905

Advanced Contact form 7 DB < 1.8.7 - Subscriber+ Arbitrary File Deletion

The Advanced Contact form 7 DB WordPress plugin before 1.8.7 does not have authorisation nor CSRF checks in the acf7_db_edit_scr_file_delete AJAX action, and does not validate the file to be deleted, allowing any authenticated user to delete arbitrary files on the web server. For example, removing the wp-config.php allows attackers to trigger WordPress setup again, gain administrator privileges and execute arbitrary code or display arbitrary content to the users.

CVSS 3.1 · 8.0 High EPSS < 1% KEV · Not listed
Vendors
Vsourz
Products
Advanced Cf7 Db
CVE-2021-24872

Get Custom Field Values < 4.0 - Contributors+ Arbitrary Post Metadata Access

The Get Custom Field Values WordPress plugin before 4.0 allows users with a role as low as Contributor to access other posts metadata without validating the permissions. Eg. contributors can access admin posts metadata.

CVSS 3.1 · 6.5 Medium EPSS 1.0% KEV · Not listed
Vendors
Get Custom Field Values Project
Products
Get Custom Field Values
CVE-2021-24851

Insert Pages < 3.7.0 - Contributor+ Arbitrary Posts/Pages Access

The Insert Pages WordPress plugin before 3.7.0 allows users with a role as low as Contributor to access content and metadata from arbitrary posts/pages regardless of their author and status (ie private), using a shortcode. Password protected posts/pages are not affected by such issue.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed
Vendors
Insert Pages Project
Products
Insert Pages
CVE-2021-24842

Bulk Datetime Change < 1.12 - Missing Authorisation

The Bulk Datetime Change WordPress plugin before 1.12 does not enforce capability checks which allows users with Contributor roles to 1) list private post titles of other users and 2) change the posted date of other users' posts.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed
Vendors
Bulk Datetime Change Project
Products
Bulk Datetime Change
CVE-2021-24839

SupportCandy < 2.2.5 - Unauthenticated Arbitrary Ticket Deletion

The SupportCandy WordPress plugin before 2.2.5 does not have authorisation and CSRF checks in its wpsc_tickets AJAX action, which could allow unauthenticated users to call it and delete arbitrary tickets via the set_delete_permanently_bulk_ticket setting_action. Other actions may be affected as well.

CVSS 3.1 · 7.5 High EPSS 1.2% KEV · Not listed
Vendors
Supportcandy
Products
Supportcandy
CVE-2021-24836

Temporary Login Without Password < 1.7.1 - Subscriber+ Plugin's Settings Update

The Temporary Login Without Password WordPress plugin before 1.7.1 does not have authorisation and CSRF checks when updating its settings, which could allows any logged-in users, such as subscribers to update them

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed
Vendors
Storeapps
Products
Temporary Login Without Password
CVE-2021-24831

Tab - Accordion, FAQ < 1.3.2 - Unauthenticated AJAX Calls

All AJAX actions of the Tab WordPress plugin before 1.3.2 are available to both unauthenticated and authenticated users, allowing unauthenticated attackers to modify various data in the plugin, such as add/edit/delete arbitrary tabs.

CVSS 3.1 · 7.5 High EPSS 1.2% KEV · Not listed
Vendors
Rich-web
Products
Tab
CVE-2021-24824

Custom Content Shortcode < 4.0.1 - Unauthorised Arbitrary Post Metadata Access

The [field] shortcode included with the Custom Content Shortcode WordPress plugin before 4.0.1, allows authenticated users with a role as low as contributor, to access arbitrary post metadata. This could lead to sensitive data disclosure, for example when used in combination with WooCommerce, the email address of orders can be retrieved

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed
Vendors
Custom Content Shortcode Project
Products
Custom Content Shortcode
CVE-2021-24819

Page/Post Content Shortcode <= 1.0 - Contributor+ Arbitrary Posts/Pages Access

The Page/Post Content Shortcode WordPress plugin through 1.0 does not have proper authorisation in place, allowing users with a role as low as contributor to access draft/private/password protected/trashed posts/pages they should not be allowed to, including posts created by other users such as admins and editors.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed
Vendors
Page\/post Content Shortcode Project
Products
Page\/post Content Shortcode
CVE-2021-24790

Contact Form Advanced Database <= 1.0.8 - Unauthorised AJAX Calls

The Contact Form Advanced Database WordPress plugin through 1.0.8 does not have any authorisation as well as CSRF checks in its delete_cf7_data and export_cf7_data AJAX actions, available to any authenticated users, which could allow users with a role as low as subscriber to call them. The delete_cf7_data would lead to arbitrary metadata deletion, as well as PHP Object Injection if a suitable gadget chain is present in another plugin, as user data is passed to the maybe_unserialize() function without being first validated.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed
Vendors
Contact Form Advanced Database Project
Products
Contact Form Advanced Database
CVE-2021-24788

Batch Cat <= 0.3 - Subscriber+ Arbitrary Categories Add/Set/Delete to Posts

The Batch Cat WordPress plugin through 0.3 defines 3 custom AJAX actions, which both require authentication but are available for all roles. As a result, any authenticated user (including simple subscribers) can add/set/delete arbitrary categories to posts.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Batch Cat Project
Products
Batch Cat
CVE-2021-24783

Post Expirator < 2.6.0 - Contributor+ Arbitrary Post Schedule Deletion

The Post Expirator WordPress plugin before 2.6.0 does not have proper capability checks in place, which could allow users with a role as low as Contributor to schedule deletion of arbitrary posts.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Publishpress
Products
Post Expirator
CVE-2021-24779

WP Debugging < 2.11.0 - Unauthenticated Plugin's Settings Update

The WP Debugging WordPress plugin before 2.11.0 has its update_settings() function hooked to admin_init and is missing any authorisation and CSRF checks, as a result, the settings can be updated by unauthenticated users.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Wp Debugging Project
Products
Wp Debugging
CVE-2021-24770

Stylish Price List < 6.9.1 - Subscriber+ Arbitrary Image Upload

The Stylish Price List WordPress plugin before 6.9.1 does not perform capability checks in its spl_upload_ser_img AJAX action (available to authenticated users), which could allow any authenticated users, such as subscriber, to upload arbitrary images.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Stylishpricelist
Products
Stylish Price List
CVE-2021-24757

Stylish Price List < 6.9.0 - Unauthenticated Arbitrary Image Upload

The Stylish Price List WordPress plugin before 6.9.0 does not perform capability checks in its spl_upload_ser_img AJAX action (available to both unauthenticated and authenticated users), which could allow unauthenticated users to upload images.

CVSS 3.1 · 5.3 Medium EPSS 1.1% KEV · Not listed
Vendors
Stylishpricelist
Products
Stylish Price List
CVE-2021-24742

Logo Slider and Showcase < 1.3.37 - Editor Plugin's Settings Update

The Logo Slider and Showcase WordPress plugin before 1.3.37 allows Editor users to update the plugin's settings via the rtWLSSettings AJAX action because it uses a nonce for authorisation instead of a capability check.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Radiustheme
Products
Logo Slider And Showcase
CVE-2021-24733

WP Post Page Clone < 1.2 - Unauthorised Post Access

The WP Post Page Clone WordPress plugin before 1.2 allows users with a role as low as Contributor to clone and view other users' draft and password-protected posts which they cannot view normally.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed
Vendors
Wp Post Page Clone Project
Products
Wp Post Page Clone