CVE-2021-24151: Benjaminrojas Wp Editor

High severity, CVSS 7.2. EPSS: 0.8% chance of exploitation in the next 30 days.

The WP Editor WordPress plugin before 1.2.7 did not sanitise or validate its setting fields leading to an authenticated (admin+) blind SQL injection issue via an arbitrary parameter when making a request to save the settings.

Affected products

• Benjaminrojas Wp Editor: before 1.2.7 (fixed in 1.2.7)

Published 2024-01-16. Last modified 2026-06-17.