Export limit exceeded: 97600 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (97600 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2021-24748 | 1 Mandsconsulting | 1 Email Before Download | 2024-11-21 | 8.8 High |
| The Email Before Download WordPress plugin before 6.8 does not properly validate and escape the order and orderby GET parameters before using them in SQL statements, leading to authenticated SQL injection issues | ||||
| CVE-2021-24747 | 1 Cleverplugins | 1 Seo Booster | 2024-11-21 | 7.2 High |
| The SEO Booster WordPress plugin before 3.8 allows for authenticated SQL injection via the "fn_my_ajaxified_dataloader_ajax" AJAX request as the $_REQUEST['order'][0]['dir'] parameter is not properly escaped leading to blind and error-based SQL injections. | ||||
| CVE-2021-24739 | 1 Shapedplugin | 1 Logo Carousel | 2024-11-21 | 8.1 High |
| The Logo Carousel WordPress plugin before 3.4.2 allows users with a role as low as Contributor to duplicate and view arbitrary private posts made by other users via the Carousel Duplication feature | ||||
| CVE-2021-24728 | 1 Cozmoslabs | 1 Membership \& Content Restriction - Paid Member Subscriptions | 2024-11-21 | 8.8 High |
| The Membership & Content Restriction – Paid Member Subscriptions WordPress plugin before 2.4.2 did not sanitise, validate or escape its order and orderby parameters before using them in SQL statement, leading to Authenticated SQL Injections in the Members and Payments pages. | ||||
| CVE-2021-24726 | 1 Wpsimplebookingcalendar | 1 Wp Simple Booking Calendar | 2024-11-21 | 8.8 High |
| The WP Simple Booking Calendar WordPress plugin before 2.0.6 did not escape, validate or sanitise the orderby parameter in its Search Calendars action, before using it in a SQL statement, leading to an authenticated SQL injection issue | ||||
| CVE-2021-24717 | 1 Automatorwp | 1 Automatorwp | 2024-11-21 | 8.8 High |
| The AutomatorWP WordPress plugin before 1.7.6 does not perform capability checks which allows users with Subscriber roles to enumerate automations, disclose title of private posts or user emails, call functions, or perform privilege escalation via Ajax actions. | ||||
| CVE-2021-24711 | 1 Tipsandtricks-hq | 1 Software License Manager | 2024-11-21 | 8.8 High |
| The del_reistered_domains AJAX action of the Software License Manager WordPress plugin before 4.5.1 does not have any CSRF checks, and is vulnerable to a CSRF attack | ||||
| CVE-2021-24704 | 1 Orange-form Project | 1 Orange-form | 2024-11-21 | 8.8 High |
| In the Orange Form WordPress plugin through 1.0, the process_bulk_action() function in "admin/orange-form-email.php" performs an unprepared SQL query with an unsanitized parameter ($id). Only admin can access the page that invokes the function, but because of lack of CSRF protection, it is actually exploitable and could allow attackers to make a logged in admin delete arbitrary posts for example | ||||
| CVE-2021-24696 | 1 Tipsandtricks-hq | 1 Simple Download Monitor | 2024-11-21 | 8.8 High |
| The Simple Download Monitor WordPress plugin before 3.9.9 does not enforce nonce checks, which could allow attackers to perform CSRF attacks to 1) make admins export logs to exploit a separate log disclosure vulnerability (fixed in 3.9.6), 2) delete logs (fixed in 3.9.9), 3) remove thumbnail image from downloads | ||||
| CVE-2021-24695 | 1 Tipsandtricks-hq | 1 Simple Download Monitor | 2024-11-21 | 7.5 High |
| The Simple Download Monitor WordPress plugin before 3.9.6 saves logs in a predictable location, and does not have any authentication or authorisation in place to prevent unauthenticated users to download and read the logs containing Sensitive Information such as IP Addresses and Usernames | ||||
| CVE-2021-24684 | 1 Teamlead | 1 Pdf-light-viewer | 2024-11-21 | 8.8 High |
| The WordPress PDF Light Viewer Plugin WordPress plugin before 1.4.12 allows users with Author roles to execute arbitrary OS command on the server via OS Command Injection when invoking Ghostscript. | ||||
| CVE-2021-24669 | 1 Feataholic | 1 Maz Loader | 2024-11-21 | 8.8 High |
| The MAZ Loader – Preloader Builder for WordPress plugin before 1.3.3 does not validate or escape the loader_id parameter of the mzldr shortcode, which allows users with a role as low as Contributor to perform SQL injection. | ||||
| CVE-2021-24663 | 1 Simple Schools Staff Directory Project | 1 Simple Schools Staff Directory | 2024-11-21 | 7.2 High |
| The Simple Schools Staff Directory WordPress plugin through 1.1 does not validate uploaded logo pictures to ensure that are indeed images, allowing high privilege users such as admin to upload arbitrary file like PHP, leading to RCE | ||||
| CVE-2021-24662 | 1 Game-server-status Project | 1 Game-server-status | 2024-11-21 | 7.2 High |
| The Game Server Status WordPress plugin through 1.0 does not validate or escape the server_id parameter before using it in SQL statement, leading to an Authenticated SQL Injection in an admin page | ||||
| CVE-2021-24655 | 1 Wpusermanager | 1 Wp User Manager | 2024-11-21 | 7.5 High |
| The WP User Manager WordPress plugin before 2.6.3 does not ensure that the user ID to reset the password of is related to the reset key given. As a result, any authenticated user can reset the password (to an arbitrary value) of any user knowing only their ID, and gain access to their account. | ||||
| CVE-2021-24651 | 1 Ays-pro | 1 Poll Maker | 2024-11-21 | 7.5 High |
| The Poll Maker WordPress plugin before 3.4.2 allows unauthenticated users to perform SQL injection via the ays_finish_poll AJAX action. While the result is not disclosed in the response, it is possible to use a timing attack to exfiltrate data such as password hash. | ||||
| CVE-2021-24647 | 1 Genetechsolutions | 1 Pie Register | 2024-11-21 | 8.1 High |
| The Registration Forms – User profile, Content Restriction, Spam Protection, Payment Gateways, Invitation Codes WordPress plugin before 3.1.7.6 has a flaw in the social login implementation, allowing unauthenticated attacker to login as any user on the site by only knowing their user ID or username | ||||
| CVE-2021-24644 | 1 Imagestowebp Project | 1 Images To Webp | 2024-11-21 | 7.5 High |
| The Images to WebP WordPress plugin before 1.9 does not validate or sanitise the tab parameter before passing it to the include() function, which could lead to a Local File Inclusion issue | ||||
| CVE-2021-24641 | 1 Imagestowebp Project | 1 Images To Webp | 2024-11-21 | 8.1 High |
| The Images to WebP WordPress plugin before 1.9 does not have CSRF checks in place when performing some administrative actions, which could result in modification of plugin settings, Denial-of-Service, as well as arbitrary image conversion | ||||
| CVE-2021-24639 | 1 Ffw | 1 Omgf | 2024-11-21 | 8.1 High |
| The OMGF WordPress plugin before 4.5.4 does not enforce path validation, authorisation and CSRF checks in the omgf_ajax_empty_dir AJAX action, which allows any authenticated users to delete arbitrary files or folders on the server. | ||||