CVE-2021-24562

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

The LMS by LifterLMS – Online Course, Membership & Learning Management System Plugin for WordPress plugin before 4.21.2 was affected by an IDOR issue, allowing students to see other student answers and grades

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-639

Affected software

No affected versions have been published.

Timeline

Published
Aug 23, 2021
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2021

CVE-2021-245636.1The Frontend Uploader WordPress plugin through 1.3.2 does not prevent HTML files from being uploaded via its form, allowing unauthenticated CVE-2021-245645.4The WPFront Scroll Top WordPress plugin before 2.0.6.07225 does not sanitise or escape its Image ALT setting before outputting it attributesCVE-2021-245658.8The Contact Form 7 Captcha WordPress plugin before 0.0.9 does not have any CSRF check in place when saving its settings, allowing attacker tCVE-2021-245668.8The WooCommerce Currency Switcher FOX WordPress plugin before 1.3.7 was vulnerable to LFI attacks via the "woocs" shortcode.CVE-2021-245675.4The Simple Post WordPress plugin through 1.1 does not sanitize user input when an authenticated user Text value, then it does not escape theCVE-2021-245685.4The AddToAny Share Buttons WordPress plugin before 1.7.46 does not sanitise its Sharing Header setting when outputting it in frontend pages,CVE-2021-245694.8The Cookie Notice & Compliance for GDPR / CCPA WordPress plugin before 2.1.2 does not escape the value of its Button Text setting when outpuCVE-2021-24575.3Vulnerability in the Identity Manager product of Oracle Fusion Middleware (component: Request Management & Workflow). The supported version CVE-2021-245704.3The Accept Donations with PayPal WordPress plugin before 1.3.1 offers a function to create donation buttons, which internally are posts. TheCVE-2021-245715.4The HD Quiz WordPress plugin before 1.8.4 does not escape some of its Answers before outputting them in attribute when generating the Quiz, CVE-2021-245724.3The Accept Donations with PayPal WordPress plugin before 1.3.1 provides a function to create donation buttons which are internally stored asCVE-2021-245744.8The Simple Banner WordPress plugin before 2.10.4 does not sanitise and escape one of its settings, allowing high privilege users such as adm
CVE-2021-24562: High severity, CVSS 7.5 | Vulnix