{"cve":"CVE-2021-24825","nvd":{"published":"2022-03-07T09:15:08.210","modified":"2026-06-17T03:40:58.307","status":"Modified","description":"The Custom Content Shortcode WordPress plugin before 4.0.2 does not validate the data passed to its load shortcode, which could allow Contributor+ (v < 4.0.1) or Admin+ (v < 4.0.2) users to display arbitrary files from the filesystem (such as logs, .htaccess etc), as well as perform Local File Inclusion attacks as PHP files will be executed. Please note that such attack is still possible by admin+ in single site blogs by default (but won't be when either the unfiltered_html or file_edit is disallowed)","cvss_v4":null,"cvss_v3":{"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","score":4.3},"cwes":["CWE-345"],"references":["https://wpscan.com/vulnerability/be9d6f82-c972-459a-bacf-65b3dfb11a09","https://wpscan.com/vulnerability/be9d6f82-c972-459a-bacf-65b3dfb11a09"],"products":["custom_content_shortcode_project:custom_content_shortcode"],"source":"nvd","synced_at":"2026-10-19T21:28:04.509275555+00:00"},"epss":{"cve":"CVE-2021-24825","score":0.00442,"percentile":0.38424,"date":"2026-11-01"},"kev":null,"osv":[],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}