CVE-2021-24566

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

The WooCommerce Currency Switcher FOX WordPress plugin before 1.3.7 was vulnerable to LFI attacks via the "woocs" shortcode.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-22

Affected software

VendorProductVersions
UnknownFOX< 1.3.7

References

Timeline

Published
Jan 16, 2024
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2021

CVE-2021-245675.4The Simple Post WordPress plugin through 1.1 does not sanitize user input when an authenticated user Text value, then it does not escape theCVE-2021-245685.4The AddToAny Share Buttons WordPress plugin before 1.7.46 does not sanitise its Sharing Header setting when outputting it in frontend pages,CVE-2021-245694.8The Cookie Notice & Compliance for GDPR / CCPA WordPress plugin before 2.1.2 does not escape the value of its Button Text setting when outpuCVE-2021-24575.3Vulnerability in the Identity Manager product of Oracle Fusion Middleware (component: Request Management & Workflow). The supported version CVE-2021-245704.3The Accept Donations with PayPal WordPress plugin before 1.3.1 offers a function to create donation buttons, which internally are posts. TheCVE-2021-245715.4The HD Quiz WordPress plugin before 1.8.4 does not escape some of its Answers before outputting them in attribute when generating the Quiz, CVE-2021-245724.3The Accept Donations with PayPal WordPress plugin before 1.3.1 provides a function to create donation buttons which are internally stored asCVE-2021-245744.8The Simple Banner WordPress plugin before 2.10.4 does not sanitise and escape one of its settings, allowing high privilege users such as admCVE-2021-245758.8The School Management System – WPSchoolPress WordPress plugin before 2.1.10 does not properly sanitize or use prepared statements before usiCVE-2021-245765.4The Easy Accordion WordPress plugin before 2.0.22 does not properly sanitize inputs when adding new items to an accordion.CVE-2021-245775.4The Coming soon and Maintenance mode WordPress plugin before 3.5.3 does not properly sanitize inputs submitted by authenticated users when sCVE-2021-245786.1The SportsPress WordPress plugin before 2.7.9 does not sanitise and escape its match_day parameter before outputting back in the Events back
CVE-2021-24566: High severity, CVSS 8.8 | Vulnix