blogsafe.org My Downloads

BlogSafe.org

WordPress CVEs

Search and review WordPress-related vulnerability records.

← Back to CVE list

CVE-2021-24630

HIGH 8.8 CVSS 3.1
Published
November 8, 2021
Last modified
June 17, 2026
NVD status
Modified
Reported by
contact@wpscan.com
Weakness
CWE-89
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Description

The Schreikasten WordPress plugin through 0.14.18 does not sanitise or escape the id GET parameter before using it in SQL statements in the comments dashboard from various actions, leading to authenticated SQL Injections which can be exploited by users as low as author

Affected WordPress components

  • schreikasten Plugin · schreikasten
    Confirmed match Homeless
    From 0.14.18 (including) to 0.14.18 (including); Up to and including 0.14.18
    View on WordPress.org

A confirmed match is backed by the plugin or theme slug. A possible match is based on the product name only and should be verified.

Affected products and versions

  • Unknown Schreikasten — From 0.14.18 (including) to 0.14.18 (including)
  • schreikasten_project schreikasten — Up to and including 0.14.18

References

  • codevigilant.com https://codevigilant.com/disclosure/2021/wp-plugin-schreikasten/ Exploit, Third Party Advisory
  • wpscan.com https://wpscan.com/vulnerability/a0787dae-a4b7-4248-9960-aaffabfaeb9f Exploit, Third Party Advisory
  • nvd.nist.gov Official NVD record