CVEs published January 1, 2021
19 CVEs were published on January 1, 2021: 6 critical, 8 high.
- Published
- 19
- Critical
- 6
- High
- 8
- Medium
- 3
- Low
- 0
- Unrated
- 2
- Now in CISA KEV
- 0
- Fix available
- 0
Critical 6
- CVE-2020-35945An issue was discovered in the Divi Builder plugin, Divi theme, and Divi Extra theme before 4.5.3 for WordPress.
- CVE-2020-35948An issue was discovered in the XCloner Backup and Restore plugin before 4.2.13 for WordPress.
- CVE-2020-35949An issue was discovered in the Quiz and Survey Master plugin before 7.0.1 for WordPress.
- CVE-2020-35950An issue was discovered in the XCloner Backup and Restore plugin before 4.2.153 for WordPress.
- CVE-2020-35951An issue was discovered in the Quiz and Survey Master plugin before 7.0.1 for WordPress.
- CVE-2020-35391Tenda N300 F3 12.01.01.48 devices allow remote attackers to obtain sensitive information (possibly including an http_passwd line) via a dire
High 8
- CVE-2020-35944An issue was discovered in the PageLayer plugin before 1.1.2 for WordPress.
- CVE-2020-35947An issue was discovered in the PageLayer plugin before 1.1.2 for WordPress.
- CVE-2020-35939PHP Object injection vulnerabilities in the Team Showcase plugin before 1.22.16 for WordPress allow remote authenticated attackers to inject
- CVE-2020-35938PHP Object injection vulnerabilities in the Post Grid plugin before 2.0.73 for WordPress allow remote authenticated attackers to inject arbi
- CVE-2020-35937Stored Cross-Site Scripting (XSS) vulnerabilities in the Team Showcase plugin before 1.22.16 for WordPress allow remote authenticated attack
- CVE-2020-35936Stored Cross-Site Scripting (XSS) vulnerabilities in the Post Grid plugin before 2.0.73 for WordPress allow remote authenticated attackers t
- CVE-2020-35935The Advanced Access Manager plugin before 6.6.2 for WordPress allows privilege escalation on profile updates via the aam_user_roles POST par
- CVE-2020-35932Insecure Deserialization in the Newsletter plugin before 6.8.2 for WordPress allows authenticated remote attackers with minimal privileges (
Medium, low and unrated 5
- CVE-2021-3002Seo Panel 4.8.0 allows reflected XSS via the seo/seopanel/login.php?sec=forgot email parameter.
- CVE-2020-35717zonote through 0.4.0 allows XSS via a crafted note, with resultant Remote Code Execution (because nodeIntegration in webPreferences is true)
- CVE-2020-35946An issue was discovered in the All in One SEO Pack plugin before 3.6.2 for WordPress.
- CVE-2020-35934The Advanced Access Manager plugin before 6.6.2 for WordPress displays the unfiltered user object (including all metadata) upon login via th
- CVE-2020-35933A Reflected Authenticated Cross-Site Scripting (XSS) vulnerability in the Newsletter plugin before 6.8.2 for WordPress allows remote attacke