CVEs-PoC/2021/CVE-2021-24506.md

CVE-2021-24506

Description

The Slider Hero with Animation, Video Background & Intro Maker WordPress plugin before 8.2.7 does not sanitise or escape the id attribute of its hero-button shortcode before using it in a SQL statement, allowing users with a role as low as Contributor to perform SQL injection.

POC

Reference

• https://wpscan.com/vulnerability/52c8755c-46b9-4383-8c8d-8816f03456b0
• https://wpscan.com/vulnerability/52c8755c-46b9-4383-8c8d-8816f03456b0

Github

No PoCs found on GitHub currently.