High severity8.8NVD Advisory· Published Nov 8, 2021· Updated Jun 17, 2026
CVE-2021-24835
CVE-2021-24835
Description
The WCFM – Frontend Manager for WooCommerce along with Bookings Subscription Listings Compatible WordPress plugin before 6.5.12, when used in combination with another WCFM - WooCommerce Multivendor plugin such as WCFM - WooCommerce Multivendor Marketplace, does not escape the withdrawal_vendor parameter before using it in a SQL statement, allowing low privilege users such as Subscribers to perform SQL injection attacks
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
3- cpe:2.3:a:wclovers:frontend_manager_for_woocommerce_along_with_bookings_subscription_listings_compatible:*:*:*:*:*:wordpress:*:*Range: <6.5.12
- WordPress/WCFM – Frontend Manager for WooCommerce along with Bookings Subscription Listings Compatibledescription
- Range: <6.5.12
Patches
Vulnerability mechanics
References
1- wpscan.com/vulnerability/c493ac9c-67d1-48a9-be21-824b1a1d56c2nvdExploitThird Party Advisory
News mentions
0No linked articles in our index yet.