blogsafe.org My Downloads

BlogSafe.org

WordPress CVEs

Search and review WordPress-related vulnerability records.

← Back to CVE list

CVE-2021-24922

CRITICAL 9.0 CVSS 3.1
Published
December 13, 2021
Last modified
June 17, 2026
NVD status
Modified
Reported by
contact@wpscan.com
Weakness
CWE-352
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H

Description

The Pixel Cat WordPress plugin before 2.6.2 does not have CSRF check when saving its settings, and did not sanitise as well as escape some of them, which could allow attacker to make a logged in admin change them and perform Cross-Site Scripting attacks

Affected WordPress components

  • Pixel Cat – Conversion Pixel Manager Plugin · facebook-conversion-pixel
    Confirmed match Active
    From 2.6.2 (including) to 2.6.2 (excluding)
    View on WordPress.org

A confirmed match is backed by the plugin or theme slug. A possible match is based on the product name only and should be verified.

Affected products and versions

  • Unknown Pixel Cat – Conversion Pixel Manager — From 2.6.2 (including) to 2.6.2 (excluding)
  • fatcatapps pixel_cat — Before 2.6.2

References

  • wpscan.com https://wpscan.com/vulnerability/399ffd65-f3c0-4fbe-a83a-2a620976aad2 Exploit, Third Party Advisory
  • nvd.nist.gov Official NVD record