CVE-2021-24546

🗓️ 11 Oct 2021 10:45:29Reported by WPScanType

cve🔗 web.nvd.nist.gov👁 58 Views🌐 WEB

The Gutenberg Block Editor Toolkit - EditorsKit WordPress plugin before 1.31.6 allows arbitrary PHP code execution

Reporter	Title	Published	Views	Family All 12
Circl	CVE-2021-24546	11 Oct 202114:24	–	circl
CNNVD	WordPress 插件代码注入漏洞	11 Oct 202100:00	–	cnnvd
CNVD	WordPress Gutenberg Block Editor Toolkit-EditorsKit plugin code injection vulnerability	13 Oct 202100:00	–	cnvd
Cvelist	CVE-2021-24546 EditorsKit < 1.31.6 - Contributor+ Arbitrary PHP Code Execution	11 Oct 202110:45	–	cvelist
EUVD	EUVD-2021-11458	7 Oct 202500:30	–	euvd
NVD	CVE-2021-24546	11 Oct 202111:15	–	nvd
OSV	CVE-2021-24546	11 Oct 202111:15	–	osv
Patchstack	WordPress Gutenberg Block Editor Toolkit plugin <= 1.31.5 - Arbitrary PHP Code Execution vulnerability	13 Sep 202100:00	–	patchstack
Prion	Code injection	11 Oct 202111:15	–	prion
RedhatCVE	CVE-2021-24546	22 May 202518:34	–	redhatcve

NVD

Vulners

Node

extendify editorskitRange<1.31.6wordpress

[
  {
    "product": "Gutenberg Block Editor Toolkit – EditorsKit",
    "vendor": "Unknown",
    "versions": [
      {
        "lessThan": "1.31.6",
        "status": "affected",
        "version": "1.31.6",
        "versionType": "custom"
      }
    ]
  }
]

Source	Link
wpscan	www.wpscan.com/vulnerability/bdc36f6a-682d-4d66-b587-92e86085d971

Parameter	Position	Path	Description	CWE
c	query param	/?p=1079&preview=true&c=%3C?php%20echo%20%27Failed%27;%20?%3E	Exploits unsanitized Conditional Logic in EditorsKit to execute PHP payload via the c parameter during post preview	CWE-94

17 Jun 2026 03:40Current

8.9High risk

Vulners AI Score8.9

CVSS 26.5

CVSS 3.18.8

EPSS0.01753

CWE-94