CVE-2021-4227

MediumCVSS 5.3/10Last modified Jun 17, 2026

Description

The ark-commenteditor WordPress plugin through 2.15.6 does not properly sanitise or encode the comments when in Source editor, allowing attackers to inject an iFrame in the page and thus load arbitrary content from any page to the comment section

Metrics

CVSS 3.1 5.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Weakness enumeration

CWE-74

Affected software

VendorProductVersions
Unknownark-commenteditor<= 2.15.6

References

Timeline

Published
Jan 16, 2024
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2021

CVE-2021-422707.8Adobe Animate version 21.0.9 (and earlier) are affected by an out-of-bounds write vulnerability that could result in arbitrary code executioCVE-2021-422717.8Adobe Animate version 21.0.9 (and earlier) are affected by an out-of-bounds write vulnerability that could result in arbitrary code executioCVE-2021-422727.8Adobe Animate version 21.0.9 (and earlier) are affected by an out-of-bounds write vulnerability that could result in arbitrary code executioCVE-2021-422746.8Windows Hyper-V Discrete Device Assignment (DDA) Denial of Service VulnerabilityCVE-2021-422758.8Microsoft COM for Windows Remote Code Execution VulnerabilityCVE-2021-422767.8Microsoft Windows Media Foundation Remote Code Execution VulnerabilityCVE-2021-422775.5Diagnostics Hub Standard Collector Elevation of Privilege VulnerabilityCVE-2021-422787.5Active Directory Domain Services Elevation of Privilege VulnerabilityCVE-2021-422794.2Chakra Scripting Engine Memory Corruption VulnerabilityCVE-2021-42287.4Use of hard-coded TLS certificate by default allows an attacker to perform Man-in-the-Middle (MitM) attacks even in the presence of the HTTPCVE-2021-422805.5Windows Feedback Hub Elevation of Privilege VulnerabilityCVE-2021-422827.5Active Directory Domain Services Elevation of Privilege Vulnerability
CVE-2021-4227: Medium severity, CVSS 5.3 | Vulnix