blogsafe.org My Downloads

BlogSafe.org

WordPress CVEs

Search and review WordPress-related vulnerability records.

← Back to CVE list

CVE-2021-24831

HIGH 7.5 CVSS 3.1
Published
January 3, 2022
Last modified
June 17, 2026
NVD status
Modified
Reported by
contact@wpscan.com
Weakness
CWE-862, CWE-425
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Description

All AJAX actions of the Tab WordPress plugin before 1.3.2 are available to both unauthenticated and authenticated users, allowing unauthenticated attackers to modify various data in the plugin, such as add/edit/delete arbitrary tabs.

Affected products and versions

  • Unknown Tab – Accordion, FAQ — From 1.3.2 (including) to 1.3.2 (excluding)
  • rich-web tab — Before 1.3.2

References

  • wpscan.com https://wpscan.com/vulnerability/75ed9f5f-e091-4372-a6cb-57958ad5f900 Exploit, Third Party Advisory
  • nvd.nist.gov Official NVD record