CVE-2021-24957

PoC —

CVSS 3.1

8.8 high

EPSS

1%p70

Published

Apr 25, 2022 (Apr 25, 2022)

Modified

Jun 17, 2026

Description

The Advanced Page Visit Counter WordPress plugin before 6.1.6 does not escape the artID parameter before using it in a SQL statement in the apvc_reset_count_art AJAX action, available to any authenticated user, leading to a SQL injection

Vendors: advanced page visit counter project
Products: advanced page visit counter
Ecosystems: WordPress
Weakness: CWE-89
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

NVD CVE.org GitHub PoCs EPSS (1.3%)

In the news0 stories

No ingested article mentions this CVE yet.