{"vulnerability": "CVE-2021-2458", "sightings": [{"uuid": "0a8fd351-3bc4-4d03-bca3-0dcbf43af5a4", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "2a075640-a300-48a4-bb44-bc6130783b9b", "vulnerability": "CVE-2021-24585", "type": "seen", "source": "https://t.me/cibsecurity/29089", "content": "\u203c CVE-2021-24585 \u203c\n\nThe Timetable and Event Schedule WordPress plugin before 2.4.0 outputs the Hashed Password, Username and Email Address (along other less sensitive data) of the user related to the Even Head of the Timeslot in the response when requesting the event Timeslot data with a user with the edit_posts capability. Combined with the other Unauthorised Event Timeslot Modification issue (https://wpscan.com/reports/submissions/4699/) where an arbitrary user ID can be set, this could allow low privilege users with the edit_posts capability (such as author) to retrieve sensitive User data by iterating over the user_id\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2021-09-20T14:26:51.000000Z"}, {"uuid": "db35ed3d-0d11-45a8-aa36-664fff5e1b2b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "2a075640-a300-48a4-bb44-bc6130783b9b", "vulnerability": "CVE-2021-24587", "type": "seen", "source": "https://t.me/cibsecurity/29101", "content": "\u203c CVE-2021-24587 \u203c\n\nThe Splash Header WordPress plugin before 1.20.8 doesn't sanitise and escape some of its settings while outputting them in the admin dashboard, leading to an authenticated Stored Cross-Site Scripting issue.\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2021-09-20T14:27:08.000000Z"}, {"uuid": "7d91e4cb-fffe-43f5-b961-0e92441c62ff", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "2a075640-a300-48a4-bb44-bc6130783b9b", "vulnerability": "CVE-2021-24588", "type": "seen", "source": "https://t.me/cibsecurity/28271", "content": "\u203c CVE-2021-24588 \u203c\n\nThe SMS Alert Order Notifications WordPress plugin before 3.4.7 is affected by a cross site scripting (XSS) vulnerability in the plugin's setting page.\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2021-09-06T14:40:32.000000Z"}, {"uuid": "a14f6799-8949-4a8a-b5f0-bf60b32a929a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "2a075640-a300-48a4-bb44-bc6130783b9b", "vulnerability": "CVE-2021-24581", "type": "seen", "source": "https://t.me/cibsecurity/28006", "content": "\u203c CVE-2021-24581 \u203c\n\nThe Blue Admin WordPress plugin through 21.06.01 does not sanitise or escape its \"Logo Title\" setting before outputting in a page, leading to a Stored Cross-Site Scripting issue. Furthermore, the plugin does not have CSRF check in place when saving its settings, allowing the issue to be exploited via a CSRF attack.\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2021-08-30T18:32:24.000000Z"}, {"uuid": "d638037f-bb97-440d-a7a6-9949e0970cfe", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "2a075640-a300-48a4-bb44-bc6130783b9b", "vulnerability": "CVE-2021-24580", "type": "seen", "source": "https://t.me/cibsecurity/28001", "content": "\u203c CVE-2021-24580 \u203c\n\nThe Side Menu Lite WordPress plugin before 2.2.6 does not sanitise user input from the List page in the admin dashboard before using it in SQL statement, leading to a SQL Injection issue\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2021-08-30T18:32:19.000000Z"}]}