CVE-2021-24143

HIGH

AccessPress Social Icons < 1.8.1 - Authenticated SQL Injection via Widget Attribute

Title source: llm
STIX 2.1

Description

Unvalidated input in the AccessPress Social Icons plugin, versions before 1.8.1, did not sanitise its widget attribute, allowing accounts with post permission, such as author, to perform SQL injections.

References (1)

Core 1
Core References

Scores

CVSS v3 8.8
EPSS 0.0126
EPSS Percentile 66.1%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Details

CWE
CWE-89
Status published
Products (1)
accesspressthemes/accesspress_social_icons < 1.8.1
Published Mar 18, 2021
Tracked Since Feb 18, 2026