CVE-2021-24625: Web-Dorado Spidercatalog

High severity, CVSS 7.2. EPSS: 1.5% chance of exploitation in the next 30 days.

The SpiderCatalog WordPress plugin through 1.7.3 does not sanitise or escape the 'parent' and 'ordering' parameters from the admin dashboard before using them in a SQL statement, leading to a SQL injection when adding a category

Affected products

• Web-Dorado Spidercatalog: up to and including 1.7.3

Published 2021-11-08. Last modified 2026-06-17.