{"vulnerability": "CVE-2021-2427", "sightings": [{"uuid": "43c081b3-e2e3-445c-8dc2-ff9c262f7951", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-24275", "type": "confirmed", "source": "https://github.com/projectdiscovery/nuclei-templates/tree/main/http/cves/2021/CVE-2021-24275.yaml", "content": "", "creation_timestamp": "2023-04-27T09:58:59.000000Z"}, {"uuid": "16cf7254-d5ff-4690-9068-68a888f478ed", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-24276", "type": "published-proof-of-concept", "source": "https://t.me/CyberSecurityTechnologies/3300", "content": "#exploit\nWordPress vulnerabilities:\n\n1. CVE-2021-24258:\nElements Kit Lite/Elements Kit Pro WordPress Plugins <2.2.0 have a number of widgets that are vulnerable to stored XSS by lower-privileged users such as contributors, all via a similar method\nhttps://github.com/GoogleProjectZer0/CVE-2021-24258\n\n2. PoC script to exploit CVE-2021-24276:\nhttps://github.com/GoogleProjectZer0/CVE-2021-24276", "creation_timestamp": "2021-12-07T03:34:20.000000Z"}, {"uuid": "3f97fc00-3471-43f5-91da-c6cbec16d9b5", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-24276", "type": "seen", "source": "https://t.me/cissp/3138", "content": "WordPress vulnerabilities:\ud83d\ude01\nCVE-2021-24258 - Elements Kit Lite/Elements Kit Pro WordPress Plugins <2.2.0 have a number of widgets that are vulnerable to stored XSS by lower-privileged users such as contributors, all via a similar method\nhttps://github.com/GoogleProjectZer0/CVE-2021-24258\n+ PoC script to exploit CVE-2021-24276\nhttps://github.com/GoogleProjectZer0/CVE-2021-24276\n\nThreat Research:\n1. Privilege Escalation Via a Use After Free Vulnerability\nIn win32k (PoC for CVE-2021-26900, CVE-2020-1381)\nhttps://www.zerodayinitiative.com/blog/2021/5/3/cve-2021-26900-privilege-escalation-via-a-use-after-free-vulnerability-in-win32k\n2. The authentication bypass flaw affects HPE Edgeline Infrastructure Manager (EIM) ver.1.21\nhttps://securityaffairs.co/wordpress/117513/security/hpe-edgeline-infrastructure-manager-flaw.html?utm_source=feedly&utm_medium=rss&utm_campaign=hpe-edgeline-infrastructure-manager-flaw\n\nA Simple Android Remote Administration Tool Using Sockets. It uses java on the client side and python on the server side\nhttps://github.com/karma9874/AndroRAT", "creation_timestamp": "2026-09-01T17:00:50.943348Z"}, {"uuid": "101e279b-ec43-48aa-a06f-a7c49567741b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-24275", "type": "seen", "source": "https://t.me/hacking_Attack/25368", "content": "Exploit Collector\nWordPress Popup 1.10.4 Cross Site Scripting\n\nhttps://3.bp.blogspot.com/-Ct9xsH2cBRo/WWlviFueiJI/AAAAAAAAIQc/IuoXrqbibrUTnkZ-3FJLKgVXuEB0NPH5wCLcBGAs/s1600/h92.png \nWordPress Popup plugin version 1.10.4 suffers from a cross site scripting vulnerability.\n\nMD5 | 34a0b77cf58a9d881b2693bb8571e695\n\nDownload\n# Exploit Title: WordPress Plugin Popup 1.10.4 - Reflected Cross-Site Scripting (XSS)\n# Date: 3/28/2021\n# Author: 0xB9\n# Software Link: https://wordpress.org/plugins/popup-by-supsystic/\n# Version: 1.10.4\n# Tested on: Windows 10\n# CVE: CVE-2021-24275\n\n1. Description:\nThe plugin did not sanitize the tab parameter of its options page before outputting it in an attribute, leading to a reflected Cross-Site Scripting issue\n\n2. Proof of Concept:\n/wp-admin/admin.php?page=popup-wp-supsystic&tab=\"+style=animation-name:rotation+onanimationstart=alert(/XSS/)//\n\nSource:packetstormsecurity.com\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "creation_timestamp": "2026-09-01T20:02:20.048297Z"}, {"uuid": "c5482284-1ad7-450d-8d59-d34064751b8a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-24274", "type": "seen", "source": "https://t.me/hacking_Attack/25377", "content": "Exploit Collector\nWordPress Ultimate Maps 1.2.4 Cross Site Scripting\n\nhttps://2.bp.blogspot.com/-8IZk1MGzGDs/WWlvRc2I8KI/AAAAAAAAINM/SaF41lFV3n4aBJrQBjJ2SaVGr7WaiJo3gCLcBGAs/s1600/h34.png \nWordPress Ultimate Maps plugin version 1.2.4 suffers from a cross site scripting vulnerability.\n\nMD5 | a15131838592d920ab537cfb27e37ab4\n\nDownload\n# Exploit Title: WordPress Plugin Ultimate Maps 1.2.4 - Reflected Cross-Site Scripting (XSS)\n# Date: 3/28/2021\n# Author: 0xB9\n# Software Link: https://wordpress.org/plugins/ultimate-maps-by-supsystic/\n# Version: 1.2.4\n# Tested on: Windows 10\n# CVE: CVE-2021-24274\n\n1. Description:\nThe plugin did not sanitize the tab parameter of its options page before outputting it in an attribute, leading to a reflected Cross-Site Scripting issue\n\n2. Proof of Concept:\n/wp-admin/admin.php?page=ultimate-maps-supsystic&tab=\"+style=animation-name:rotation+onanimationstart=alert(/XSS/)//\n\nSource:packetstormsecurity.com\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "creation_timestamp": "2026-09-01T20:02:20.095083Z"}, {"uuid": "12c36378-7faa-4d50-8208-4058173dbbe2", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-24276", "type": "seen", "source": "https://t.me/hacking_Attack/25365", "content": "Exploit Collector\nWordPress Contact Form 1.7.14 Cross Site Scripting\n\nhttps://2.bp.blogspot.com/-S-N0q2XL8x8/WWlu5FDj1eI/AAAAAAAAIJA/vGskVQb_QegQZ0-UZMHSDeFJ08ju6pdGQCLcBGAs/s1600/h104.png \nWordPress Contact Form plugin version 1.7.14 suffers from a cross site scripting vulnerability.\n\nMD5 | ad3b8c07914e764e78a039113f3ce4a9\n\nDownload\n# Exploit Title: WordPress Plugin Contact Form 1.7.14 - Reflected Cross-Site Scripting (XSS)\n# Date: 3/28/2021\n# Author: 0xB9\n# Software Link: https://wordpress.org/plugins/contact-form-by-supsystic/\n# Version: 1.7.14\n# Tested on: Windows 10\n# CVE: CVE-2021-24276\n\n1. Description:\nThe Contact Form by Supsystic WordPress plugin before 1.7.15 did not sanitise the tab parameter of its options page before outputting it in an attribute, leading to a reflected Cross-Site Scripting issue\n\n2. Proof of Concept:\n/wp-admin/admin.php?page=contact-form-supsystic&tab=\"+style=animation-name:rotation+onanimationstart=alert(/XSS/)//\n\nSource:packetstormsecurity.com\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "creation_timestamp": "2026-09-01T20:02:20.362239Z"}, {"uuid": "2b437877-ab69-4a23-8aa3-5a87781b5238", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-24272", "type": "seen", "source": "https://t.me/hacking_Attack/24642", "content": "Exploit Collector\nWordPress Fitness Calculators 1.9.5 Cross Site Request Forgery\n\nhttps://4.bp.blogspot.com/-4IgemuXxvlQ/WWlvJOAjEHI/AAAAAAAAIL4/GJdo6H5fQo4z7HKyurc-fIH3InSyWxX3gCLcBGAs/s1600/h145.png \nWordPress Fitness Calculators plugin version 1.9.5 suffers from a cross site request forgery vulnerability.\n\nMD5 | 30ca373f3886f6f98013bb82a0a42e7c\n\nDownload\n# Exploit Title: WordPress Plugin Fitness Calculators 1.9.5 - Cross-Site Request Forgery (CSRF)\n# Date: 2/28/2021\n# Author: 0xB9\n# Software Link: https://wordpress.org/plugins/fitness-calculators/\n# Version: 1.9.5\n# Tested on: Windows 10\n# CVE: CVE-2021-24272\n\n1. Description:\nThe plugin add calculators for Water intake, BMI calculator, protein Intake, and Body Fat and was lacking CSRF check, allowing attackers to make logged in users perform unwanted actions, such as change the calculator headers. \nDue to the lack of sanitisation, this could also lead to a Stored Cross-Site Scripting issue\n\n2. Proof of Concept:\n\nSource:packetstormsecurity.com", "creation_timestamp": "2026-09-01T20:02:20.986777Z"}, {"uuid": "2c29a0b7-60d4-4c39-9b79-2dbac141d086", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-24272", "type": "seen", "source": "https://t.me/hacking_Attack/24642", "content": "Exploit Collector\nWordPress Fitness Calculators 1.9.5 Cross Site Request Forgery\n\nhttps://4.bp.blogspot.com/-4IgemuXxvlQ/WWlvJOAjEHI/AAAAAAAAIL4/GJdo6H5fQo4z7HKyurc-fIH3InSyWxX3gCLcBGAs/s1600/h145.png \nWordPress Fitness Calculators plugin version 1.9.5 suffers from a cross site request forgery vulnerability.\n\nMD5 | 30ca373f3886f6f98013bb82a0a42e7c\n\nDownload\n# Exploit Title: WordPress Plugin Fitness Calculators 1.9.5 - Cross-Site Request Forgery (CSRF)\n# Date: 2/28/2021\n# Author: 0xB9\n# Software Link: https://wordpress.org/plugins/fitness-calculators/\n# Version: 1.9.5\n# Tested on: Windows 10\n# CVE: CVE-2021-24272\n\n1. Description:\nThe plugin add calculators for Water intake, BMI calculator, protein Intake, and Body Fat and was lacking CSRF check, allowing attackers to make logged in users perform unwanted actions, such as change the calculator headers. \nDue to the lack of sanitisation, this could also lead to a Stored Cross-Site Scripting issue\n\n2. Proof of Concept:\n\nSource:packetstormsecurity.com", "creation_timestamp": "2026-09-02T01:02:50.321066Z"}, {"uuid": "de362285-de6d-4ede-9e3a-37d2050fce7b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-24275", "type": "seen", "source": "https://t.me/hacking_Attack/25368", "content": "Exploit Collector\nWordPress Popup 1.10.4 Cross Site Scripting\n\nhttps://3.bp.blogspot.com/-Ct9xsH2cBRo/WWlviFueiJI/AAAAAAAAIQc/IuoXrqbibrUTnkZ-3FJLKgVXuEB0NPH5wCLcBGAs/s1600/h92.png \nWordPress Popup plugin version 1.10.4 suffers from a cross site scripting vulnerability.\n\nMD5 | 34a0b77cf58a9d881b2693bb8571e695\n\nDownload\n# Exploit Title: WordPress Plugin Popup 1.10.4 - Reflected Cross-Site Scripting (XSS)\n# Date: 3/28/2021\n# Author: 0xB9\n# Software Link: https://wordpress.org/plugins/popup-by-supsystic/\n# Version: 1.10.4\n# Tested on: Windows 10\n# CVE: CVE-2021-24275\n\n1. Description:\nThe plugin did not sanitize the tab parameter of its options page before outputting it in an attribute, leading to a reflected Cross-Site Scripting issue\n\n2. Proof of Concept:\n/wp-admin/admin.php?page=popup-wp-supsystic&tab=\"+style=animation-name:rotation+onanimationstart=alert(/XSS/)//\n\nSource:packetstormsecurity.com\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "creation_timestamp": "2026-09-02T01:02:49.253726Z"}, {"uuid": "5b99fb4d-7fb2-485d-ad90-14e9bc34a728", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-24274", "type": "seen", "source": "https://t.me/hacking_Attack/25377", "content": "Exploit Collector\nWordPress Ultimate Maps 1.2.4 Cross Site Scripting\n\nhttps://2.bp.blogspot.com/-8IZk1MGzGDs/WWlvRc2I8KI/AAAAAAAAINM/SaF41lFV3n4aBJrQBjJ2SaVGr7WaiJo3gCLcBGAs/s1600/h34.png \nWordPress Ultimate Maps plugin version 1.2.4 suffers from a cross site scripting vulnerability.\n\nMD5 | a15131838592d920ab537cfb27e37ab4\n\nDownload\n# Exploit Title: WordPress Plugin Ultimate Maps 1.2.4 - Reflected Cross-Site Scripting (XSS)\n# Date: 3/28/2021\n# Author: 0xB9\n# Software Link: https://wordpress.org/plugins/ultimate-maps-by-supsystic/\n# Version: 1.2.4\n# Tested on: Windows 10\n# CVE: CVE-2021-24274\n\n1. Description:\nThe plugin did not sanitize the tab parameter of its options page before outputting it in an attribute, leading to a reflected Cross-Site Scripting issue\n\n2. Proof of Concept:\n/wp-admin/admin.php?page=ultimate-maps-supsystic&tab=\"+style=animation-name:rotation+onanimationstart=alert(/XSS/)//\n\nSource:packetstormsecurity.com\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "creation_timestamp": "2026-09-02T01:02:49.297025Z"}, {"uuid": "13a22933-9d43-4cad-8d23-57f2f21a8098", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-24276", "type": "seen", "source": "https://t.me/hacking_Attack/25365", "content": "Exploit Collector\nWordPress Contact Form 1.7.14 Cross Site Scripting\n\nhttps://2.bp.blogspot.com/-S-N0q2XL8x8/WWlu5FDj1eI/AAAAAAAAIJA/vGskVQb_QegQZ0-UZMHSDeFJ08ju6pdGQCLcBGAs/s1600/h104.png \nWordPress Contact Form plugin version 1.7.14 suffers from a cross site scripting vulnerability.\n\nMD5 | ad3b8c07914e764e78a039113f3ce4a9\n\nDownload\n# Exploit Title: WordPress Plugin Contact Form 1.7.14 - Reflected Cross-Site Scripting (XSS)\n# Date: 3/28/2021\n# Author: 0xB9\n# Software Link: https://wordpress.org/plugins/contact-form-by-supsystic/\n# Version: 1.7.14\n# Tested on: Windows 10\n# CVE: CVE-2021-24276\n\n1. Description:\nThe Contact Form by Supsystic WordPress plugin before 1.7.15 did not sanitise the tab parameter of its options page before outputting it in an attribute, leading to a reflected Cross-Site Scripting issue\n\n2. Proof of Concept:\n/wp-admin/admin.php?page=contact-form-supsystic&tab=\"+style=animation-name:rotation+onanimationstart=alert(/XSS/)//\n\nSource:packetstormsecurity.com\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "creation_timestamp": "2026-09-02T01:02:49.558516Z"}, {"uuid": "435fe150-54ea-452a-86f3-a4b31840b594", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-24276", "type": "seen", "source": "https://t.me/cissp/3138", "content": "WordPress vulnerabilities:\ud83d\ude01\nCVE-2021-24258 - Elements Kit Lite/Elements Kit Pro WordPress Plugins <2.2.0 have a number of widgets that are vulnerable to stored XSS by lower-privileged users such as contributors, all via a similar method\nhttps://github.com/GoogleProjectZer0/CVE-2021-24258\n+ PoC script to exploit CVE-2021-24276\nhttps://github.com/GoogleProjectZer0/CVE-2021-24276\n\nThreat Research:\n1. Privilege Escalation Via a Use After Free Vulnerability\nIn win32k (PoC for CVE-2021-26900, CVE-2020-1381)\nhttps://www.zerodayinitiative.com/blog/2021/5/3/cve-2021-26900-privilege-escalation-via-a-use-after-free-vulnerability-in-win32k\n2. The authentication bypass flaw affects HPE Edgeline Infrastructure Manager (EIM) ver.1.21\nhttps://securityaffairs.co/wordpress/117513/security/hpe-edgeline-infrastructure-manager-flaw.html?utm_source=feedly&utm_medium=rss&utm_campaign=hpe-edgeline-infrastructure-manager-flaw\n\nA Simple Android Remote Administration Tool Using Sockets. It uses java on the client side and python on the server side\nhttps://github.com/karma9874/AndroRAT", "creation_timestamp": "2026-09-02T01:04:40.033515Z"}]}