CVE-2021-24791

PoC —

CVSS 3.1

7.2 high

EPSS

5%p92

Published

Nov 8, 2021 (Nov 8, 2021)

Modified

Jun 17, 2026

Description

The Header Footer Code Manager WordPress plugin before 1.1.14 does not validate and escape the "orderby" and "order" request parameters before using them in a SQL statement when viewing the Snippets admin dashboard, leading to SQL injections

Vendors: draftpress
Products: header footer code manager
Ecosystems: WordPress
Weakness: CWE-89
Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

NVD CVE.org GitHub PoCs EPSS (5.2%)

In the news0 stories

No ingested article mentions this CVE yet.