CVE-2021-25013

MediumCVSS 6.5/10Last modified Jun 17, 2026

Description

The Qubely WordPress plugin before 1.7.8 does not have authorisation and CSRF check on the qubely_delete_saved_block AJAX action, and does not ensure that the block to be deleted belong to the plugin, as a result, any authenticated users, such as subscriber can delete arbitrary posts

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

Weakness enumeration

CWE-862CWE-352

Affected software

No affected versions have been published.

Timeline

Published
Jan 24, 2022
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2021

CVE-2021-250143.5The Ibtana WordPress plugin before 1.1.4.9 does not have authorisation and CSRF checks in the ive_save_general_settings AJAX action, allowinCVE-2021-250156.1The myCred WordPress plugin before 2.4 does not sanitise and escape the search query before outputting it back in the history dashboard pageCVE-2021-250166.1The Chaty WordPress plugin before 2.8.3 and Chaty Pro WordPress plugin before 2.8.2 do not sanitise and escape the search parameter before oCVE-2021-250176.1The Tutor LMS WordPress plugin before 1.9.12 does not escape the search parameter before outputting it back in an attribute in an admin pageCVE-2021-250185.4The PPOM for WooCommerce WordPress plugin before 24.0 does not have authorisation and CSRF checks in the ppom_settings_panel_action AJAX actCVE-2021-250196.1The SEO Plugin by Squirrly SEO WordPress plugin before 11.1.12 does not escape the type parameter before outputting it back in an attribute CVE-2021-250204.9The CAOS | Host Google Analytics Locally WordPress plugin before 4.1.9 does not validate the cache directory setting, allowing high privilegCVE-2021-250214.9The OMGF | Host Google Fonts Locally WordPress plugin before 4.5.12 does not validate the cache directory setting, allowing high privilege uCVE-2021-250226.1The UpdraftPlus WordPress Backup Plugin WordPress plugin before 1.16.66 does not sanitise and escape the backup_timestamp and job_id parametCVE-2021-250237.2The Speed Booster Pack ⚡ PageSpeed Optimization Suite WordPress plugin before 4.3.3.1 does not escape the sbp_convert_table_name parameter bCVE-2021-250246.1The EventCalendar WordPress plugin before 1.1.51 does not escape some user input before outputting it back in attributes, leading to ReflectCVE-2021-250254.3The EventCalendar WordPress plugin before 1.1.51 does not have proper authorisation and CSRF checks in the add_calendar_event AJAX actions,
CVE-2021-25013: Medium severity, CVSS 6.5 | Vulnix