CVSS: 8.8EPSS: 0%CPEs: 1EXPL: 1CVE-2021-25054 – WPcalc <= 2.1 - Authenticated SQL Injection
https://notcve.org/view.php?id=CVE-2021-25054
The WPcalc WordPress plugin through 2.1 does not sanitize user input into the 'did' parameter and uses it in a SQL statement, leading to an authenticated SQL Injection vulnerability. El plugin Wpcalc de WordPress versiones hasta 2.1, no sanea la entrada del usuario en el parámetro "did" y lo usa en una sentencia SQL, conllevando a una vulnerabilidad de inyección SQL autenticada • https://wpscan.com/vulnerability/200969eb-e2a4-4200-82d7-0c313de089af • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •
CVSS: 8.8EPSS: 1%CPEs: 1EXPL: 1CVE-2021-25052 – Button Generator < 2.3.3 - RFI leading to RCE via CSRF
https://notcve.org/view.php?id=CVE-2021-25052
The Button Generator WordPress plugin before 2.3.3 within the wow-company admin menu page allows to include() arbitrary file with PHP extension (as well as with data:// or http:// protocols), thus leading to CSRF RCE. El plugin Button Generator de WordPress versiones anteriores a 2.3.3, dentro de la página del menú de administración de wow-company permite incluir() un archivo arbitrario con extensión PHP (así como con los protocolos data:// o http://), conllevando a un ataque de tipo CSRF RCE The Button Generator WordPress plugin before 2.3.2 within the wow-company admin menu page allows to include() arbitrary file with PHP extension (as well as with data:// or http:// protocols), thus leading to CSRF RCE. • https://plugins.trac.wordpress.org/changeset/2641639/button-generation https://wpscan.com/vulnerability/a01844a0-0c43-4d96-b738-57fe5bfbd67a • CWE-352: Cross-Site Request Forgery (CSRF) •
CVSS: 8.8EPSS: 0%CPEs: 1EXPL: 1CVE-2021-25051 – Modal Window < 5.2.2 - RFI leading to RCE via CSRF
https://notcve.org/view.php?id=CVE-2021-25051
The Modal Window WordPress plugin before 5.2.2 within the wow-company admin menu page allows to include() arbitrary file with PHP extension (as well as with data:// or http:// protocols), thus leading to CSRF RCE. El plugin Modal Window de WordPress versiones anteriores a 5.2.2, dentro de la página del menú de administración de wow-company permite incluir() un archivo arbitrario con extensión PHP (así como con los protocolos data:// o http://), conllevando a un ataque de tipo CSRF RCE • https://plugins.trac.wordpress.org/changeset/2641645/modal-window https://wpscan.com/vulnerability/566ff8dc-f820-412b-b2d3-fa789bce528e • CWE-352: Cross-Site Request Forgery (CSRF) •
CVSS: 8.8EPSS: 0%CPEs: 1EXPL: 1CVE-2021-25053 – WP Coder < 2.5.2 - RFI leading to RCE via CSRF
https://notcve.org/view.php?id=CVE-2021-25053
The WP Coder WordPress plugin before 2.5.2 within the wow-company admin menu page allows to include() arbitrary file with PHP extension (as well as with data:// or http:// protocols), thus leading to CSRF RCE. El plugin WP Coder de WordPress versiones anteriores a 2.5.2, dentro de la página del menú de administración de wow-company permite incluir() un archivo arbitrario con extensión PHP (así como con los protocolos data:// o http://), conllevando a un ataque de tipo CSRF RCE • https://plugins.trac.wordpress.org/changeset/2641650/wp-coder https://wpscan.com/vulnerability/a5448599-64de-43b0-b04d-c6492366eab1 • CWE-352: Cross-Site Request Forgery (CSRF) •
CVSS: 7.2EPSS: 0%CPEs: 1EXPL: 2CVE-2021-24628 – Wow Forms <= 3.1.3 - Admin+ SQL Injection
https://notcve.org/view.php?id=CVE-2021-24628
The Wow Forms WordPress plugin through 3.1.3 does not sanitise or escape a 'did' GET parameter before using it in a SQL statement, when deleting a form in the admin dashboard, leading to an authenticated SQL injection El plugin Wow Forms de WordPress versiones hasta 3.1.3, no sanea o escapa de un parámetro GET "did" antes de usarlo en una sentencia SQL, cuando se borra un formulario en el panel de administración, conllevando a una inyección SQL autenticada The Wow Forms WordPress plugin through 3.1.3 does not sanitise or escape a 'did' GET parameter before using it in a SQL statement, when deleting a form in the admin dashboard, leading to an authenticated SQL injection. • https://codevigilant.com/disclosure/2021/wp-plugin-mwp-forms https://wpscan.com/vulnerability/d742ab35-4e2d-42a8-bebc-b953b2e10e3c • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •