High severity · published Aug 2, 2021
CVE-2021-24460
Popup Like box - Page Plugin < 3.5.3 - Authenticated Blind SQL Injections
8.8
CVSS
1.4%
EPSS
No
On KEV
Description
The get_fb_likeboxes() function in the Popup Like box – Page Plugin WordPress plugin before 3.5.3 did not use whitelist or validate the orderby parameter before using it in SQL statements passed to the get_results() DB calls, leading to SQL injection issues in the admin dashboard
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)1.4% · higher than 72% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
PL
Popup Like box – Page Plugin · Ays Pro
3.5.3 before 3.5.3 · source: vendor
PB
Popup Box · Ays-pro
before 3.5.3 · source: NVD