{"vulnerability": "CVE-2021-2457", "sightings": [{"uuid": "ffa31d29-cd5e-4cf9-800f-f7cdf773dbde", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "2a075640-a300-48a4-bb44-bc6130783b9b", "vulnerability": "CVE-2021-24578", "type": "seen", "source": "https://t.me/cibsecurity/34419", "content": "\u203c CVE-2021-24578 \u203c\n\nThe SportsPress WordPress plugin before 2.7.9 does not sanitise and escape its match_day parameter before outputting back in the Events backend page, leading to a Reflected Cross-Site Scripting issue\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2021-12-21T12:23:44.000000Z"}, {"uuid": "0b648d5f-bc75-4183-9650-6d42aa076af7", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "2a075640-a300-48a4-bb44-bc6130783b9b", "vulnerability": "CVE-2021-24575", "type": "seen", "source": "https://t.me/cibsecurity/31997", "content": "\u203c CVE-2021-24575 \u203c\n\nThe School Management System \u00c3\u00a2\u00e2\u201a\u00ac\u00e2\u20ac\u0153 WPSchoolPress WordPress plugin before 2.1.10 does not properly sanitize or use prepared statements before using POST variable in SQL queries, leading to SQL injection in multiple actions available to various authenticated users, from simple subscribers/students to teachers and above.\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2021-11-08T20:29:26.000000Z"}, {"uuid": "4b7c246d-9745-47b6-990c-0479ee8efdc1", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "2a075640-a300-48a4-bb44-bc6130783b9b", "vulnerability": "CVE-2021-24570", "type": "seen", "source": "https://t.me/cibsecurity/31523", "content": "\u203c CVE-2021-24570 \u203c\n\nThe Accept Donations with PayPal WordPress plugin before 1.3.1 offers a function to create donation buttons, which internally are posts. The process to create a new button is lacking a CSRF check. An attacker could use this to make an authenticated admin create a new button. Furthermore, one of the Button field is not escaped before being output in an attribute when editing a Button, leading to a Stored Cross-Site Scripting issue as well.\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2021-11-01T11:21:02.000000Z"}, {"uuid": "2e697047-8876-46e0-8362-efec1ef4d5b9", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "2a075640-a300-48a4-bb44-bc6130783b9b", "vulnerability": "CVE-2021-24572", "type": "seen", "source": "https://t.me/cibsecurity/31527", "content": "\u203c CVE-2021-24572 \u203c\n\nThe Accept Donations with PayPal WordPress plugin before 1.3.1 provides a function to create donation buttons which are internally stored as posts. The deletion of a button is not CSRF protected and there is no control to check if the deleted post was a button post. As a result, an attacker could make logged in admins delete arbitrary posts\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2021-11-01T11:21:08.000000Z"}, {"uuid": "ef6a005d-59c5-4edd-aee8-397f47e74a32", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "2a075640-a300-48a4-bb44-bc6130783b9b", "vulnerability": "CVE-2021-24577", "type": "seen", "source": "https://t.me/cibsecurity/30318", "content": "\u203c CVE-2021-24577 \u203c\n\nThe Coming soon and Maintenance mode WordPress plugin before 3.5.3 does not properly sanitize inputs submitted by authenticated users when setting adding or modifying coming soon or maintenance mode pages, leading to stored XSS.\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2021-10-11T14:24:33.000000Z"}, {"uuid": "85189965-0a50-438a-b2d6-7e4524b20ba3", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "2a075640-a300-48a4-bb44-bc6130783b9b", "vulnerability": "CVE-2021-24576", "type": "seen", "source": "https://t.me/cibsecurity/30312", "content": "\u203c CVE-2021-24576 \u203c\n\nThe Easy Accordion WordPress plugin before 2.0.22 does not properly sanitize inputs when adding new items to an accordion.\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2021-10-11T14:24:24.000000Z"}, {"uuid": "58ca6904-7765-46f5-ac1a-26a23cfa7360", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "2a075640-a300-48a4-bb44-bc6130783b9b", "vulnerability": "CVE-2021-24579", "type": "seen", "source": "https://t.me/cibsecurity/28012", "content": "\u203c CVE-2021-24579 \u203c\n\nThe bt_bb_get_grid AJAX action of the Bold Page Builder WordPress plugin before 3.1.6 passes user input into the unserialize() function without any validation or sanitisation, which could lead to a PHP Object Injection. Even though the plugin did not contain a suitable gadget to fully exploit the issue, other installed plugins on the blog could allow such issue to be exploited and lead to RCE in some cases.\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2021-08-30T18:32:30.000000Z"}, {"uuid": "bb60486e-f264-467f-9764-0e92c8eeb3dc", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "2a075640-a300-48a4-bb44-bc6130783b9b", "vulnerability": "CVE-2021-24571", "type": "seen", "source": "https://t.me/cibsecurity/27689", "content": "\u203c CVE-2021-24571 \u203c\n\nThe HD Quiz WordPress plugin before 1.8.4 does not escape some of its Answers before outputting them in attribute when generating the Quiz, which could lead to Stored Cross-Site Scripting issues\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2021-08-23T16:23:07.000000Z"}]}