CVE-2021-24360: Kohsei-Works Yes/no Chart

Medium severity, CVSS 6.5. EPSS: 1.2% chance of exploitation in the next 30 days.

The Yes/No Chart WordPress plugin before 1.0.12 did not sanitise its sid shortcode parameter before using it in a SQL statement, allowing medium privilege users (contributor+) to perform Blind SQL Injection attacks

Affected products

• Kohsei-Works Yes/no Chart: before 1.0.12 (fixed in 1.0.12)

Published 2021-06-14. Last modified 2026-06-17.