CVE-2021-24393

HIGH

Comment Highlighter < 0.13 - SQL Injection via c GET Parameter

Title source: llm

Description

A c GET parameter of the Comment Highlighter WordPress plugin through 0.13 is not properly sanitised, escaped or validated before inserting to a SQL statement, leading to SQL injection.

References (2)

Core 2

Core References

Exploit, Third Party Advisory x_refsource_misc

https://wpscan.com/vulnerability/24969766-19e3-47cd-b32c-6c3330651d1f

Exploit, Third Party Advisory x_refsource_misc

https://codevigilant.com/disclosure/2021/wp-plugin-comment-highlighter/

Scores

CVSS v3 7.2

EPSS 0.0155

EPSS Percentile 72.2%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Details

CWE

CWE-89

Status published

Products (1)

comment_highlighter_project/comment_highlighter < 0.13

Published Sep 06, 2021

Tracked Since Feb 18, 2026