CVE-2021-24151

HighCVSS 7.2/10Last modified Jun 17, 2026

Description

The WP Editor WordPress plugin before 1.2.7 did not sanitise or validate its setting fields leading to an authenticated (admin+) blind SQL injection issue via an arbitrary parameter when making a request to save the settings.

Metrics

CVSS 3.1 7.2/10CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-89

Affected software

Vendor	Product	Versions
Unknown	WP Editor	< 1.2.7

References

https://wpscan.com/vulnerability/5ee77dd7-5a73-4d4e-8038-23e6e763e20c/Exploit, Third Party Advisory
https://wpscan.com/vulnerability/5ee77dd7-5a73-4d4e-8038-23e6e763e20c/Exploit, Third Party Advisory

Timeline

Published: Jan 16, 2024
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2021

CVE-2021-241526.1The "All Subscribers" setting page of Popup Builder was vulnerable to reflected Cross-Site Scripting.CVE-2021-241535.4A Stored Cross-Site Scripting vulnerability was discovered in the Yoast SEO WordPress plugin before 3.4.1, which had built-in blacklist filt CVE-2021-241544.9The Theme Editor WordPress plugin before 2.6 did not validate the GET file parameter before passing it to the download_file() function, allo CVE-2021-241557.2The WordPress Backup and Migrate Plugin – Backup Guard WordPress plugin before 1.6.0 did not ensure that the imported files are of the SGBP CVE-2021-241565.4Stored Cross-Site Scripting vulnerabilities in Testimonial Rotator 3.0.3 allow low privileged users (Contributor) to inject arbitrary JavaSc CVE-2021-241575.4Orbit Fox by ThemeIsle has a feature to add custom scripts to the header and footer of a page or post. There were no checks to verify that a CVE-2021-241586.5Orbit Fox by ThemeIsle has a feature to add a registration form to both the Elementor and Beaver Builder page builders functionality. As par CVE-2021-241598.8Due to the lack of sanitization and lack of nonce protection on the custom CSS feature, an attacker could craft a request to inject maliciou CVE-2021-24164.9Vulnerability in the Oracle Communications Session Border Controller product of Oracle Communications (component: Routing). Supported versio CVE-2021-241608.8In the Reponsive Menu (free and Pro) WordPress plugins before 4.0.4, subscribers could upload zip archives containing malicious PHP files th CVE-2021-241618.8In the Reponsive Menu (free and Pro) WordPress plugins before 4.0.4, attackers could craft a request and trick an administrator into uploadi CVE-2021-241628.8In the Reponsive Menu (free and Pro) WordPress plugins before 4.0.4, attackers could craft a request and trick an administrator into importi