CVE-2021-24629
Post Content XMLRPC <= 1.0 - Admin+ SQL Injections
The Post Content XMLRPC WordPress plugin through 1.0 does not sanitise or escape multiple GET/POST parameters before using them in SQL statements in the admin dashboard, leading to an authenticated SQL Injections
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- High
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
NVD Score used
The Post Content XMLRPC WordPress plugin through 1.0 does not sanitise or escape multiple GET/POST parameters before using them in SQL statements in the admin dashboard, leading to an authenticated SQL Injections
- Record
CVE-2021-24629- CVSS 3.1
- 7.2 High
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H - CVSS 2.0
- 6.5 Medium
AV:N/AC:L/Au:S/C:P/I:P/A:P - Weakness
- CWE-89
- Updated
- 2026-11-02
CVE ListNo score
Post Content XMLRPC <= 1.0 - Admin+ SQL Injections
The Post Content XMLRPC WordPress plugin through 1.0 does not sanitise or escape multiple GET/POST parameters before using them in SQL statements in the admin dashboard, leading to an authenticated SQL Injections
- Record
CVE-2021-24629- Weakness
- CWE-89
- Updated
- 2026-11-02
EUVDEUVD-2021-11541No score
The Post Content XMLRPC WordPress plugin through 1.0 does not sanitise or escape multiple GET/POST parameters before using them in SQL statements in the admin dashboard, leading to an authenticated SQL Injections
- Record
EUVD-2021-11541- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-v4gc-hxmp-gmwrNo score
The Post Content XMLRPC WordPress plugin through 1.0 does not sanitise or escape multiple GET...
The Post Content XMLRPC WordPress plugin through 1.0 does not sanitise or escape multiple GET/POST parameters before using them in SQL statements in the admin dashboard, leading to an authenticated SQL Injections
- Record
GHSA-v4gc-hxmp-gmwr- Weakness
- CWE-89
- Updated
- 2026-11-02
Affected products
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2021-24629 is a high vulnerability (CVSS 7.2) in Post Content Xmlrpc Project Content Xmlrpc, published November 8, 2021. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.55%, the 75th percentile. No source names a fixed version.