CVE-2021-24869

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

The WP Fastest Cache WordPress plugin before 0.9.5 does not escape user input in the set_urls_with_terms method before using it in a SQL statement, leading to an SQL injection exploitable by low privilege users such as subscriber

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-89

Affected software

No affected versions have been published.

Timeline

Published
Jan 16, 2024
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2021

CVE-2021-248706.1The WP Fastest Cache WordPress plugin before 0.9.5 is lacking a CSRF check in its wpfc_save_cdn_integration AJAX action, and does not sanitiCVE-2021-248715.4The Get Custom Field Values WordPress plugin before 4.0.1 does not escape custom fields before outputting them in the page, which could alloCVE-2021-248726.5The Get Custom Field Values WordPress plugin before 4.0 allows users with a role as low as Contributor to access other posts metadata withouCVE-2021-248736.1The Tutor LMS WordPress plugin before 1.9.11 does not sanitise and escape user input before outputting back in attributes in the Student RegCVE-2021-248746.1The Newsletter, SMTP, Email marketing and Subscribe forms by Sendinblue WordPress plugin before 3.1.31 does not escape the lang and pid paraCVE-2021-248756.1The eCommerce Product Catalog Plugin for WordPress plugin before 3.0.39 does not escape the ic-settings-search parameter before outputting iCVE-2021-248766.1The Registrations for the Events Calendar WordPress plugin before 2.7.5 does not escape the v parameter before outputting it back in an attrCVE-2021-248777.2The MainWP Child WordPress plugin before 4.1.8 does not validate the orderby and order parameter before using them in a SQL statement, leadiCVE-2021-248786.1The SupportCandy WordPress plugin before 2.2.7 does not sanitise and escape the query string before outputting it back in pages with the [wpCVE-2021-248798.8The SupportCandy WordPress plugin before 2.2.7 does not have CSRF check in the wpsc_tickets AJAX action, nor has any sanitisation or escapinCVE-2021-248805.4The SupportCandy WordPress plugin before 2.2.7 does not validate and escape the page attribute of its shortcode, which could allow users witCVE-2021-248817.5The Passster WordPress plugin before 3.5.5.9 does not properly check for password, as well as that the post to be viewed is public, allowing
CVE-2021-24869: High severity, CVSS 8.8 | Vulnix