CVE-2021-24345

6.6 mediumEPSS 1.3%

Medium (6.6) in sendit project sendit. EPSS 1.3% chance of exploitation in the next 30 days.

The page lists-management feature of the Sendit WP Newsletter WordPress plugin through 2.5.1, available to Administrator users does not sanitise, validate or escape the id_lista POST parameter before using it in SQL statement, therefore leading to Blind SQL Injection.

Severity

CVSS 3.1

6.6 medium

CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H

EPSS: 1.3% chance of exploitation in the next 30 days; higher than 71% of CVEs (scores of 2026-10-31)
CWE: CWE-89
Published: 2021-06-14
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

sendit_project:sendit

References

https://codevigilant.com/disclosure/2021/wp-plugin-sendit/
https://wpscan.com/vulnerability/02ba4d8b-f4d2-42cd-9fae-b543e112fa04
https://codevigilant.com/disclosure/2021/wp-plugin-sendit/
https://wpscan.com/vulnerability/02ba4d8b-f4d2-42cd-9fae-b543e112fa04

Check your stack JSON