Latest CVE Feed

Following is the list of latest published vulnerabilities. You can filter the list based on the severity of the vulnerability, whether it is actively exploited (also known as CISA KEV List) or remotely exploitable. You can also sort the list based on the published date, last updated date, or CVSS score.
  • 5.5

    MEDIUM
    CVE-2021-24842

    The Bulk Datetime Change WordPress plugin before 1.12 does not enforce capability checks which allows users with Contributor roles to 1) list private post titles of other users and 2) change the posted date of other users' posts.... Read more

    Affected Products : bulk_datetime_change
    • EPSS Score: %0.15
    • Published: Nov. 29, 2021
    • Modified: Nov. 21, 2024
  • 4.8

    MEDIUM
    CVE-2021-24841

    The Helpful WordPress plugin before 4.4.59 does not sanitise and escape some of its settings, which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed... Read more

    Affected Products : helpful
    • EPSS Score: %0.34
    • Published: Nov. 17, 2021
    • Modified: Nov. 21, 2024
  • 5.3

    MEDIUM
    CVE-2021-24840

    The Squaretype WordPress theme before 3.0.4 allows unauthenticated users to manipulate the query_vars used to retrieve the posts to display in one of its REST endpoint, without any validation. As a result, private and scheduled posts could be retrieved vi... Read more

    Affected Products : squaretype
    • EPSS Score: %0.28
    • Published: Nov. 08, 2021
    • Modified: Nov. 21, 2024
  • 7.5

    HIGH
    CVE-2021-24839

    The SupportCandy WordPress plugin before 2.2.5 does not have authorisation and CSRF checks in its wpsc_tickets AJAX action, which could allow unauthenticated users to call it and delete arbitrary tickets via the set_delete_permanently_bulk_ticket setting_... Read more

    Affected Products : supportcandy
    • EPSS Score: %1.12
    • Published: Feb. 07, 2022
    • Modified: Nov. 21, 2024
  • 6.1

    MEDIUM
    CVE-2021-24838

    The AnyComment WordPress plugin before 0.3.5 has an API endpoint which passes user input via the redirect parameter to the wp_redirect() function without being validated first, leading to an Open Redirect issue, which according to the vendor, is a feature... Read more

    Affected Products : anycomment
    • EPSS Score: %2.34
    • Published: Jan. 17, 2022
    • Modified: Nov. 21, 2024
  • 5.4

    MEDIUM
    CVE-2021-24837

    The Passster WordPress plugin before 3.5.5.8 does not escape the area parameter of its shortcode, which could allow users with a role as low as Contributor to perform Cross-Site Scripting attacks.... Read more

    Affected Products : passter passster
    • EPSS Score: %0.10
    • Published: Jan. 23, 2023
    • Modified: Nov. 21, 2024
  • 4.3

    MEDIUM
    CVE-2021-24836

    The Temporary Login Without Password WordPress plugin before 1.7.1 does not have authorisation and CSRF checks when updating its settings, which could allows any logged-in users, such as subscribers to update them... Read more

    Affected Products : temporary_login_without_password
    • EPSS Score: %0.07
    • Published: Dec. 13, 2021
    • Modified: Nov. 21, 2024
  • 8.8

    HIGH
    CVE-2021-24835

    The WCFM – Frontend Manager for WooCommerce along with Bookings Subscription Listings Compatible WordPress plugin before 6.5.12, when used in combination with another WCFM - WooCommerce Multivendor plugin such as WCFM - WooCommerce Multivendor Marketplace... Read more

    • EPSS Score: %0.53
    • Published: Nov. 08, 2021
    • Modified: Nov. 21, 2024
  • 5.4

    MEDIUM
    CVE-2021-24834

    The YOP Poll WordPress plugin before 6.3.1 is affected by a stored Cross-Site Scripting vulnerability which exists in the Create Poll - Options module where a user with a role as low as author is allowed to execute arbitrary script code within the context... Read more

    Affected Products : yop_poll
    • EPSS Score: %0.24
    • Published: Nov. 17, 2021
    • Modified: Nov. 21, 2024
  • 5.4

    MEDIUM
    CVE-2021-24833

    The YOP Poll WordPress plugin before 6.3.1 is affected by a stored Cross-Site Scripting vulnerability, which exists in the Admin preview module where a user with a role as low as author is allowed to execute arbitrary script code within the context of the... Read more

    Affected Products : yop_poll
    • EPSS Score: %0.23
    • Published: Nov. 17, 2021
    • Modified: Nov. 21, 2024
  • 4.3

    MEDIUM
    CVE-2021-24832

    The WP SEO Redirect 301 WordPress plugin before 2.3.2 does not have CSRF in place when deleting redirects, which could allow attackers to make a logged in admin delete them via a CSRF attack... Read more

    Affected Products : wp_seo_redirect_301
    • EPSS Score: %0.10
    • Published: Nov. 08, 2021
    • Modified: Nov. 21, 2024
  • 7.5

    HIGH
    CVE-2021-24831

    All AJAX actions of the Tab WordPress plugin before 1.3.2 are available to both unauthenticated and authenticated users, allowing unauthenticated attackers to modify various data in the plugin, such as add/edit/delete arbitrary tabs.... Read more

    Affected Products : tab
    • EPSS Score: %0.68
    • Published: Jan. 03, 2022
    • Modified: Nov. 21, 2024
  • 4.8

    MEDIUM
    CVE-2021-24830

    The Advanced Access Manager WordPress plugin before 6.8.0 does not escape some of its settings when outputting them, allowing high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed... Read more

    Affected Products : advanced_access_manager
    • EPSS Score: %0.28
    • Published: Nov. 23, 2021
    • Modified: Nov. 21, 2024
  • 8.8

    HIGH
    CVE-2021-24829

    The Visitor Traffic Real Time Statistics WordPress plugin before 3.9 does not validate and escape user input passed to the today_traffic_index AJAX action (available to any authenticated users) before using it in a SQL statement, leading to an SQL injecti... Read more

    • EPSS Score: %0.70
    • Published: Nov. 08, 2021
    • Modified: Nov. 21, 2024
  • 5.4

    MEDIUM
    CVE-2021-24828

    The Mortgage Calculator / Loan Calculator WordPress plugin before 1.5.17 does not escape the some of the attributes of its mlcalc shortcode before outputting them, which could allow users with a role as low as contributor to perform Cross-Site Scripting a... Read more

    • EPSS Score: %0.18
    • Published: Jan. 03, 2022
    • Modified: Nov. 21, 2024
  • 9.8

    CRITICAL
    CVE-2021-24827

    The Asgaros Forum WordPress plugin before 1.15.13 does not validate and escape user input when subscribing to a topic before using it in a SQL statement, leading to an unauthenticated SQL injection issue... Read more

    Affected Products : asgaros_forum
    • EPSS Score: %72.33
    • Published: Nov. 08, 2021
    • Modified: Nov. 21, 2024
  • 5.4

    MEDIUM
    CVE-2021-24826

    The Custom Content Shortcode WordPress plugin before 4.0.2 does not escape custom fields before outputting them, which could allow Contributor+ (v < 4.0.1) or Admin+ (v < 4.0.2) users to perform Cross-Site Scripting attacks even when the unfiltered_html i... Read more

    Affected Products : custom_content_shortcode
    • EPSS Score: %0.17
    • Published: Mar. 07, 2022
    • Modified: Nov. 21, 2024
  • 4.3

    MEDIUM
    CVE-2021-24825

    The Custom Content Shortcode WordPress plugin before 4.0.2 does not validate the data passed to its load shortcode, which could allow Contributor+ (v < 4.0.1) or Admin+ (v < 4.0.2) users to display arbitrary files from the filesystem (such as logs, .htacc... Read more

    Affected Products : custom_content_shortcode
    • EPSS Score: %0.07
    • Published: Mar. 07, 2022
    • Modified: Nov. 21, 2024
  • 4.3

    MEDIUM
    CVE-2021-24824

    The [field] shortcode included with the Custom Content Shortcode WordPress plugin before 4.0.1, allows authenticated users with a role as low as contributor, to access arbitrary post metadata. This could lead to sensitive data disclosure, for example when... Read more

    Affected Products : custom_content_shortcode
    • EPSS Score: %0.18
    • Published: Mar. 07, 2022
    • Modified: Nov. 21, 2024
  • 8.1

    HIGH
    CVE-2021-24823

    The Support Board WordPress plugin before 3.3.6 does not have any CSRF checks in actions handled by the include/ajax.php file, which could allow attackers to make logged in users do unwanted actions. For example, make an admin delete arbitrary files... Read more

    Affected Products : support_board
    • EPSS Score: %0.16
    • Published: Feb. 28, 2022
    • Modified: Nov. 21, 2024
Showing 20 of 291024 Results