blogsafe.org My Downloads

BlogSafe.org

WordPress CVEs

Search and review WordPress-related vulnerability records.

← Back to CVE list

CVE-2021-24626

HIGH 8.8 CVSS 3.1
Published
November 8, 2021
Last modified
June 17, 2026
NVD status
Modified
Reported by
contact@wpscan.com
Weakness
CWE-89, CWE-352
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Description

The Chameleon CSS WordPress plugin through 1.2 does not have any CSRF and capability checks in all its AJAX calls, allowing any authenticated user, such as subscriber to call them and perform unauthorised actions. One of AJAX call, remove_css, also does not sanitise or escape the css_id POST parameter before using it in a SQL statement, leading to a SQL Injection

Affected products and versions

  • Unknown Chameleon CSS — From 1.2 (including) to 1.2 (including)
  • chameleon_css_project chameleon_css — Up to and including 1.2

References

  • codevigilant.com https://codevigilant.com/disclosure/2021/wp-plugin-chameleon-css/ Exploit, Third Party Advisory
  • wpscan.com https://wpscan.com/vulnerability/06cb6c14-99b8-45b6-be2e-f4dcca8a4165 Exploit, Third Party Advisory
  • nvd.nist.gov Official NVD record