CVE-2021-24625

7.2 highEPSS 1.5%

High (7.2) in web-dorado spidercatalog. EPSS 1.5% chance of exploitation in the next 30 days.

The SpiderCatalog WordPress plugin through 1.7.3 does not sanitise or escape the 'parent' and 'ordering' parameters from the admin dashboard before using them in a SQL statement, leading to a SQL injection when adding a category

Severity

CVSS 3.1

7.2 high

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

EPSS: 1.5% chance of exploitation in the next 30 days; higher than 74% of CVEs (scores of 2026-10-31)
CWE: CWE-89
Published: 2021-11-08
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

web-dorado:spidercatalog

References

https://codevigilant.com/disclosure/2021/wp-plugin-catalog/
https://wpscan.com/vulnerability/33e4d7c6-fa6f-459f-84b9-732ec40088b8
https://codevigilant.com/disclosure/2021/wp-plugin-catalog/
https://wpscan.com/vulnerability/33e4d7c6-fa6f-459f-84b9-732ec40088b8

Check your stack JSON