CVE-2021-24791: Draftpress Header Footer Code Manager

High severity, CVSS 7.2. EPSS: 5.2% chance of exploitation in the next 30 days.

The Header Footer Code Manager WordPress plugin before 1.1.14 does not validate and escape the "orderby" and "order" request parameters before using them in a SQL statement when viewing the Snippets admin dashboard, leading to SQL injections

Affected products

• Draftpress Header Footer Code Manager: before 1.1.14 (fixed in 1.1.14)

Published 2021-11-08. Last modified 2026-06-17.