CVE-2021-24864: Wpscan Wp Cloudy

High severity, CVSS 8.8. EPSS: 1.2% chance of exploitation in the next 30 days.

The WP Cloudy, weather plugin WordPress plugin before 4.4.9 does not escape the post_id parameter before using it in a SQL statement in the admin dashboard, leading to a SQL Injection issue

Affected products

• Wpscan Wp Cloudy: before 4.4.9 (fixed in 4.4.9)

Published 2022-02-28. Last modified 2026-06-17.