Total
14524 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2021-25030 | 1 E-dynamics | 1 Events Made Easy | 2024-11-21 | 6.5 MEDIUM | 8.8 HIGH |
| The Events Made Easy WordPress plugin before 2.2.36 does not sanitise and escape the search_text parameter before using it in a SQL statement via the eme_searchmail AJAX action, available to any authenticated users. As a result, users with a role as low as subscriber can call it and perform SQL injection attacks | |||||
| CVE-2021-25023 | 1 Optimocha | 1 Speed Booster Pack | 2024-11-21 | 6.5 MEDIUM | 7.2 HIGH |
| The Speed Booster Pack ⚡ PageSpeed Optimization Suite WordPress plugin before 4.3.3.1 does not escape the sbp_convert_table_name parameter before using it in a SQL statement to convert the related table, leading to an SQL injection | |||||
| CVE-2021-25007 | 1 Molie Instructure Canvas Linking Tool Project | 1 Molie Instructure Canvas Linking Tool | 2024-11-21 | 7.5 HIGH | 9.8 CRITICAL |
| The MOLIE WordPress plugin through 0.5 does not validate and escape a post parameter before using in a SQL statement, leading to an SQL Injection | |||||
| CVE-2021-24959 | 1 Techspawn | 1 Wp-email-users | 2024-11-21 | 6.5 MEDIUM | 8.8 HIGH |
| The WP Email Users WordPress plugin through 1.7.6 does not escape the data_raw parameter in the weu_selected_users_1 AJAX action, available to any authenticated users, allowing them to perform SQL injection attacks. | |||||
| CVE-2021-24957 | 1 Advanced Page Visit Counter Project | 1 Advanced Page Visit Counter | 2024-11-21 | 6.5 MEDIUM | 8.8 HIGH |
| The Advanced Page Visit Counter WordPress plugin before 6.1.6 does not escape the artID parameter before using it in a SQL statement in the apvc_reset_count_art AJAX action, available to any authenticated user, leading to a SQL injection | |||||
| CVE-2021-24951 | 1 Thimpress | 1 Learnpress | 2024-11-21 | 7.5 HIGH | 9.8 CRITICAL |
| The LearnPress WordPress plugin before 4.1.4 does not sanitise, validate and escape the id parameter before using it in SQL statements when duplicating course/lesson/quiz/question, leading to SQL Injections issues | |||||
| CVE-2021-24949 | 1 Posimyth | 1 The Plus Addons For Elementor | 2024-11-21 | 7.5 HIGH | 9.8 CRITICAL |
| The "WP Search Filters" widget of The Plus Addons for Elementor - Pro WordPress plugin before 5.0.7 does not sanitise and escape the option parameter before using it in a SQL statement, which could lead to SQL injection | |||||
| CVE-2021-24946 | 1 Webnus | 1 Modern Events Calendar Lite | 2024-11-21 | 7.5 HIGH | 9.8 CRITICAL |
| The Modern Events Calendar Lite WordPress plugin before 6.1.5 does not sanitise and escape the time parameter before using it in a SQL statement in the mec_load_single_page AJAX action, available to unauthenticated users, leading to an unauthenticated SQL injection issue | |||||
| CVE-2021-24943 | 1 Roundupwp | 1 Registrations For The Events Calendar | 2024-11-21 | 7.5 HIGH | 9.8 CRITICAL |
| The Registrations for the Events Calendar WordPress plugin before 2.7.6 does not sanitise and escape the event_id in the rtec_send_unregister_link AJAX action (available to both unauthenticated and authenticated users) before using it in a SQL statement, leading to an unauthenticated SQL injection. | |||||
| CVE-2021-24931 | 1 Ays-pro | 1 Secure Copy Content Protection And Content Locking | 2024-11-21 | 7.5 HIGH | 9.8 CRITICAL |
| The Secure Copy Content Protection and Content Locking WordPress plugin before 2.8.2 does not escape the sccp_id parameter of the ays_sccp_results_export_file AJAX action (available to both unauthenticated and authenticated users) before using it in a SQL statement, leading to an SQL injection. | |||||
| CVE-2021-24928 | 1 Rearrange Woocommerce Products Project | 1 Rearrange Woocommerce Products | 2024-11-21 | 4.0 MEDIUM | 6.5 MEDIUM |
| The Rearrange Woocommerce Products WordPress plugin before 3.0.8 does not have proper access controls in the save_all_order AJAX action, nor validation and escaping when inserting user data in SQL statement, leading to an SQL injection, and allowing any authenticated user, such as subscriber, to modify arbitrary post content (for example with an XSS payload), as well as exfiltrate any data by copying it to another post. | |||||
| CVE-2021-24919 | 1 Wickedplugins | 1 Wicked Folders | 2024-11-21 | 6.5 MEDIUM | 8.8 HIGH |
| The Wicked Folders WordPress plugin before 2.8.10 does not sanitise and escape the folder_id parameter before using it in a SQL statement in the wicked_folders_save_sort_order AJAX action, available to any authenticated user. leading to an SQL injection | |||||
| CVE-2021-24915 | 1 Contest Gallery | 1 Contest Gallery | 2024-11-21 | 7.5 HIGH | 9.8 CRITICAL |
| The Contest Gallery WordPress plugin before 13.1.0.6 does not have capability checks and does not sanitise or escape the cg-search-user-name-original parameter before using it in a SQL statement when exporting users from a gallery, which could allow unauthenticated to perform SQL injections attacks, as well as get the list of all users registered on the blog, including their username and email address | |||||
| CVE-2021-24889 | 1 Ninjaforms | 1 Ninja Forms | 2024-11-21 | 6.5 MEDIUM | 7.2 HIGH |
| The Ninja Forms Contact Form WordPress plugin before 3.6.4 does not escape keys of the fields POST parameter, which could allow high privilege users to perform SQL injections attacks | |||||
| CVE-2021-24877 | 1 Mainwp | 1 Mainwp Child | 2024-11-21 | 6.0 MEDIUM | 7.2 HIGH |
| The MainWP Child WordPress plugin before 4.1.8 does not validate the orderby and order parameter before using them in a SQL statement, leading to an SQL injection exploitable by high privilege users such as admin when the Backup and Staging by WP Time Capsule plugin is installed | |||||
| CVE-2021-24869 | 1 Wpfastestcache | 1 Wp Fastest Cache | 2024-11-21 | N/A | 8.8 HIGH |
| The WP Fastest Cache WordPress plugin before 0.9.5 does not escape user input in the set_urls_with_terms method before using it in a SQL statement, leading to an SQL injection exploitable by low privilege users such as subscriber | |||||
| CVE-2021-24866 | 1 Wpdataaccess | 1 Wp Data Access | 2024-11-21 | 7.5 HIGH | 9.8 CRITICAL |
| The WP Data Access WordPress plugin before 5.0.0 does not properly sanitise and escape the backup_date parameter before using it a SQL statement, leading to a SQL injection issue and could allow arbitrary table deletion | |||||
| CVE-2021-24865 | 1 Acf-extended | 1 Advanced Custom Fields\ | 2024-11-21 | 6.5 MEDIUM | 7.2 HIGH |
| The Advanced Custom Fields: Extended WordPress plugin before 0.8.8.7 does not validate the order and orderby parameters before using them in a SQL statement, leading to a SQL Injection issue | |||||
| CVE-2021-24864 | 1 Wpscan | 1 Wp Cloudy | 2024-11-21 | 6.5 MEDIUM | 8.8 HIGH |
| The WP Cloudy, weather plugin WordPress plugin before 4.4.9 does not escape the post_id parameter before using it in a SQL statement in the admin dashboard, leading to a SQL Injection issue | |||||
| CVE-2021-24863 | 1 Stopbadbots | 1 Block And Stop Bad Bots | 2024-11-21 | 7.5 HIGH | 9.8 CRITICAL |
| The WP Block and Stop Bad Bots Crawlers and Spiders and Anti Spam Protection Plugin StopBadBots WordPress plugin before 6.67 does not sanitise and escape the User Agent before using it in a SQL statement to save it, leading to a SQL injection | |||||