High severity8.8NVD Advisory· Published Aug 2, 2021· Updated Jun 17, 2026

CVE-2021-24492

Description

The hndtst_action_instance_callback AJAX call of the Handsome Testimonials & Reviews WordPress plugin before 2.1.1, available to any authenticated users, does not sanitise, validate or escape the hndtst_previewShortcodeInstanceId POST parameter before using it in a SQL statement, leading to an SQL Injection issue.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

WordPress/Handsome Testimonials And Reviewsinferred2 versions
<2.1.1+ 1 more
- (no CPE)range: <2.1.1
- (no CPE)range: <2.1.1
Package: https://wordpress.org/plugins/handsome-testimonials-and-reviews

Patches

Vulnerability mechanics

References

codevigilant.com/disclosure/2021/wp-plugin-handsome-testimonials/nvdExploitPatchThird Party Advisory
wpscan.com/vulnerability/42760007-0e59-4d45-8d64-86bc0b8daceanvdExploitThird Party Advisory

News mentions

No linked articles in our index yet.

cvss	0.572
epss	0.001
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000