# CVEs published 2021-01-01

19 CVEs were published on January 1, 2021: 6 critical, 8 high. Days are UTC.

- [CVE-2021-3002](https://cve.now/CVE-2021-3002.md): Seo Panel 4.8.0 allows reflected XSS via the seo/seopanel/login.php?sec=forgot email parameter. (no CVSS)
- [CVE-2020-35717](https://cve.now/CVE-2020-35717.md): zonote through 0.4.0 allows XSS via a crafted note, with resultant Remote Code Execution (because nodeIntegration in webPreferences is true) (no CVSS)
- [CVE-2020-35944](https://cve.now/CVE-2020-35944.md): An issue was discovered in the PageLayer plugin before 1.1.2 for WordPress. (CVSS 8.8)
- [CVE-2020-35945](https://cve.now/CVE-2020-35945.md): An issue was discovered in the Divi Builder plugin, Divi theme, and Divi Extra theme before 4.5.3 for WordPress. (CVSS 9.9)
- [CVE-2020-35946](https://cve.now/CVE-2020-35946.md): An issue was discovered in the All in One SEO Pack plugin before 3.6.2 for WordPress. (CVSS 5.4)
- [CVE-2020-35947](https://cve.now/CVE-2020-35947.md): An issue was discovered in the PageLayer plugin before 1.1.2 for WordPress. (CVSS 7.4)
- [CVE-2020-35948](https://cve.now/CVE-2020-35948.md): An issue was discovered in the XCloner Backup and Restore plugin before 4.2.13 for WordPress. (CVSS 9.9)
- [CVE-2020-35949](https://cve.now/CVE-2020-35949.md): An issue was discovered in the Quiz and Survey Master plugin before 7.0.1 for WordPress. (CVSS 10.0)
- [CVE-2020-35950](https://cve.now/CVE-2020-35950.md): An issue was discovered in the XCloner Backup and Restore plugin before 4.2.153 for WordPress. (CVSS 9.8)
- [CVE-2020-35951](https://cve.now/CVE-2020-35951.md): An issue was discovered in the Quiz and Survey Master plugin before 7.0.1 for WordPress. (CVSS 9.9)
- [CVE-2020-35939](https://cve.now/CVE-2020-35939.md): PHP Object injection vulnerabilities in the Team Showcase plugin before 1.22.16 for WordPress allow remote authenticated attackers to inject (CVSS 7.5)
- [CVE-2020-35938](https://cve.now/CVE-2020-35938.md): PHP Object injection vulnerabilities in the Post Grid plugin before 2.0.73 for WordPress allow remote authenticated attackers to inject arbi (CVSS 7.5)
- [CVE-2020-35937](https://cve.now/CVE-2020-35937.md): Stored Cross-Site Scripting (XSS) vulnerabilities in the Team Showcase plugin before 1.22.16 for WordPress allow remote authenticated attack (CVSS 7.5)
- [CVE-2020-35936](https://cve.now/CVE-2020-35936.md): Stored Cross-Site Scripting (XSS) vulnerabilities in the Post Grid plugin before 2.0.73 for WordPress allow remote authenticated attackers t (CVSS 7.5)
- [CVE-2020-35935](https://cve.now/CVE-2020-35935.md): The Advanced Access Manager plugin before 6.6.2 for WordPress allows privilege escalation on profile updates via the aam\_user\_roles POST par (CVSS 7.5)
- [CVE-2020-35934](https://cve.now/CVE-2020-35934.md): The Advanced Access Manager plugin before 6.6.2 for WordPress displays the unfiltered user object (including all metadata) upon login via th (CVSS 4.3)
- [CVE-2020-35933](https://cve.now/CVE-2020-35933.md): A Reflected Authenticated Cross-Site Scripting (XSS) vulnerability in the Newsletter plugin before 6.8.2 for WordPress allows remote attacke (CVSS 6.5)
- [CVE-2020-35932](https://cve.now/CVE-2020-35932.md): Insecure Deserialization in the Newsletter plugin before 6.8.2 for WordPress allows authenticated remote attackers with minimal privileges ( (CVSS 7.5)
- [CVE-2020-35391](https://cve.now/CVE-2020-35391.md): Tenda N300 F3 12.01.01.48 devices allow remote attackers to obtain sensitive information (possibly including an http\_passwd line) via a dire (CVSS 9.6)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2021-01-01
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.