CVE-2021-24337

8.8 highEPSS 1.6%

High (8.8) in video-embed-box project video-embed-box. EPSS 1.6% chance of exploitation in the next 30 days.

The id GET parameter of one of the Video Embed WordPress plugin through 1.0's page (available via forced browsing) is not sanitised, validated or escaped before being used in a SQL statement, allowing low privilege users, such as subscribers, to perform SQL injection.

Severity

CVSS 3.1

8.8 high

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

EPSS: 1.6% chance of exploitation in the next 30 days; higher than 75% of CVEs (scores of 2026-10-31)
CWE: CWE-89
Published: 2021-06-07
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

video-embed-box_project:video-embed-box

References

https://codevigilant.com/disclosure/2021/wp-plugin-video-embed-box/
https://wpscan.com/vulnerability/a8fd8dd4-5b5e-462e-8dae-065d5e2d003a
https://codevigilant.com/disclosure/2021/wp-plugin-video-embed-box/
https://wpscan.com/vulnerability/a8fd8dd4-5b5e-462e-8dae-065d5e2d003a

Check your stack JSON