CVE-2021-24772

PoC —

CVSS 3.1

8.8 high

EPSS

2%p74

Published

Nov 17, 2021 (Nov 17, 2021)

Modified

Jun 17, 2026

Description

The Stream WordPress plugin before 3.8.2 does not sanitise and validate the order GET parameter from the Stream Records admin dashboard before using it in a SQL statement, leading to an SQL injection issue.

Vendors: xwp
Products: stream
Ecosystems: WordPress
Weakness: CWE-89
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

NVD CVE.org GitHub PoCs EPSS (1.6%)

In the news0 stories

No ingested article mentions this CVE yet.