blogsafe.org My Downloads

BlogSafe.org

WordPress CVEs

Search and review WordPress-related vulnerability records.

← Back to CVE list

CVE-2021-25084

MEDIUM 4.3 CVSS 3.1
Published
February 7, 2022
Last modified
June 17, 2026
NVD status
Modified
Reported by
contact@wpscan.com
Weakness
CWE-862
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Description

The Advanced Cron Manager WordPress plugin before 2.4.2 and Advanced Cron Manager Pro WordPress plugin before 2.5.3 do not have authorisation checks in some of their AJAX actions, allowing any authenticated users, such as subscriber to call them and add or remove events as well as schedules for example

Affected products and versions

  • Unknown Advanced Cron Manager — From 2.4.2 (including) to 2.4.2 (excluding)
  • Unknown Advanced Cron Manager Pro — From 2.5.3 (including) to 2.5.3 (excluding)
  • bracketspace advanced_cron_manager — Before 2.4.2
  • bracketspace advanced_cron_manager — Before 2.5.3

References

  • wpscan.com https://wpscan.com/vulnerability/7c5c602f-499f-431b-80bc-507053984a06 Exploit, Third Party Advisory
  • nvd.nist.gov Official NVD record