What’s Vulnerable › Vulnerabilities

CVE-2021-24345: Sendit WP Newsletter <= 2.5.1 - Authenticated (admin+) SQL Injection

• Severity: medium (CVSS 6.6 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 1.3% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2021-06-14 · updated 2026-06-17
• Weakness: CWE-89

Description

The page lists-management feature of the Sendit WP Newsletter WordPress plugin through 2.5.1, available to Administrator users does not sanitise, validate or escape the id_lista POST parameter before using it in SQL statement, therefore leading to Blind SQL Injection.

Affected products

• Sendit WP Newsletter: through 2.5.1

References

• https://codevigilant.com/disclosure/2021/wp-plugin-sendit/
• https://wpscan.com/vulnerability/02ba4d8b-f4d2-42cd-9fae-b543e112fa04
• https://codevigilant.com/disclosure/2021/wp-plugin-sendit/
• https://wpscan.com/vulnerability/02ba4d8b-f4d2-42cd-9fae-b543e112fa04

Get alerted when CVE-2021-24345 or the next vulnerability affects your stack