CVE-2021-24867

CVE-2021-24867 relates to backdoored AccessPress Themes plugins/themes distributed via the vendor site (not from wordpress.org). The vulnerability was exploited in the wild to deploy web shells and site defacements, observed by Talos IR as part of initial access through exploitation of a WordPres...

CVE-2021-24858

The CVE-2021-24858 entry concerns the WordPress plugin “Cookie Notification Plugin for WordPress.” The vulnerability is an SQL injection caused by failure to sanitize/escape the id GET parameter when fetching the admin-edit setting, in versions before 1.0.9. Impact is authenticated SQL Injection ...