{"vulnerability": "CVE-2021-2452", "sightings": [{"uuid": "620df764-1011-4857-93da-7107c458905b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "2a075640-a300-48a4-bb44-bc6130783b9b", "vulnerability": "CVE-2021-24522", "type": "seen", "source": "https://bsky.app/profile/beikokucyber.bsky.social/post/3lqv7qzuzsg24", "content": "", "creation_timestamp": "2025-06-05T21:02:23.417639Z"}, {"uuid": "6391cd1d-1051-4e80-850c-df1a08e34076", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "2a075640-a300-48a4-bb44-bc6130783b9b", "vulnerability": "CVE-2021-24527", "type": "seen", "source": "https://bsky.app/profile/beikokucyber.bsky.social/post/3lz7r6szbxi2m", "content": "", "creation_timestamp": "2025-09-19T21:02:33.298729Z"}, {"uuid": "89e0892b-ca36-49e2-a03b-01182cf3425d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "2a075640-a300-48a4-bb44-bc6130783b9b", "vulnerability": "CVE-2021-24525", "type": "seen", "source": "https://t.me/cibsecurity/29096", "content": "\u203c CVE-2021-24525 \u203c\n\nThe Shortcodes Ultimate WordPress plugin before 5.10.2 allows users with Contributor roles to perform stored XSS via shortcode attributes. Note: the plugin is inconsistent in its handling of shortcode attributes; some do escape, most don't, and there are even some attributes that are insecure by design (like [su_button]'s onclick attribute).\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2021-09-20T14:27:00.000000Z"}, {"uuid": "69d259f7-1eec-4f6a-8392-b6225caf8fca", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "2a075640-a300-48a4-bb44-bc6130783b9b", "vulnerability": "CVE-2021-24523", "type": "seen", "source": "https://t.me/cibsecurity/28747", "content": "\u203c CVE-2021-24523 \u203c\n\nThe Daily Prayer Time WordPress plugin before 2021.08.10 does not sanitise or escape some of its settings before outputting them in the page, leading to Authenticated Stored Cross-Site Scripting issues.\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2021-09-13T22:15:14.000000Z"}, {"uuid": "3329c314-65c3-4358-b1d6-baa2b2f0d30c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "2a075640-a300-48a4-bb44-bc6130783b9b", "vulnerability": "CVE-2021-24528", "type": "seen", "source": "https://t.me/cibsecurity/28003", "content": "\u203c CVE-2021-24528 \u203c\n\nThe FluentSMTP WordPress plugin before 2.0.1 does not sanitize parameters before storing the settings in the database, nor does the plugin escape the values before outputting them when viewing the SMTP settings set by this plugin, leading to a stored cross site scripting (XSS) vulnerability. Only users with roles capable of managing plugins can modify the plugin's settings.\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2021-08-30T18:32:21.000000Z"}, {"uuid": "d351102d-2e95-40bc-a737-a1024e1d6e63", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "2a075640-a300-48a4-bb44-bc6130783b9b", "vulnerability": "CVE-2021-24529", "type": "seen", "source": "https://t.me/cibsecurity/27684", "content": "\u203c CVE-2021-24529 \u203c\n\nThe Grid Gallery \u00c3\u00a2\u00e2\u201a\u00ac\u00e2\u20ac\u0153 Photo Image Grid Gallery WordPress plugin before 1.2.5 does not properly sanitize the title field for image galleries when adding them via the admin dashboard, resulting in an authenticated Stored Cross-Site Scripting vulnerability.\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2021-08-23T16:23:00.000000Z"}, {"uuid": "df76f67d-7b13-4472-b76f-f1592f737007", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "2a075640-a300-48a4-bb44-bc6130783b9b", "vulnerability": "CVE-2021-24524", "type": "seen", "source": "https://t.me/cibsecurity/27698", "content": "\u203c CVE-2021-24524 \u203c\n\nThe GiveWP \u00c3\u00a2\u00e2\u201a\u00ac\u00e2\u20ac\u0153 Donation Plugin and Fundraising Platform WordPress plugin before 2.12.0 did not escape the Donation Level setting of its Donation Forms, allowing high privilege users to use Cross-Site Scripting payloads in them.\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2021-08-23T16:23:16.000000Z"}, {"uuid": "c638e8b4-bdc9-4406-94d5-0978ee5d1748", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "2a075640-a300-48a4-bb44-bc6130783b9b", "vulnerability": "CVE-2021-24526", "type": "seen", "source": "https://t.me/cibsecurity/27366", "content": "\u203c CVE-2021-24526 \u203c\n\nThe Form Maker by 10Web \u00c3\u00a2\u00e2\u201a\u00ac\u00e2\u20ac\u0153 Mobile-Friendly Drag & Drop Contact Form Builder WordPress plugin before 1.13.60 does not escape its Form Title before outputting it in an attribute when editing a form in the admin dashboard, leading to an authenticated Stored Cross-Site Scripting issue\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2021-08-16T14:14:51.000000Z"}, {"uuid": "1a77fcf6-6a0e-48c4-b243-00cf5e874020", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "2a075640-a300-48a4-bb44-bc6130783b9b", "vulnerability": "CVE-2021-24527", "type": "seen", "source": "https://t.me/cibsecurity/27352", "content": "\u203c CVE-2021-24527 \u203c\n\nThe User Registration & User Profile \u00c3\u00a2\u00e2\u201a\u00ac\u00e2\u20ac\u0153 Profile Builder WordPress plugin before 3.4.9 has a bug allowing any user to reset the password of the admin of the blog, and gain unauthorised access, due to a bypass in the way the reset key is checked. Furthermore, the admin will not be notified of such change by email for example.\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2021-08-16T14:14:30.000000Z"}]}