CVE-2021-24506: Slider Hero < 8.2.7 - Contributor+ SQL Injection

Severity: high (CVSS 8.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.4% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2021-08-23 · updated 2026-06-17
Weakness: CWE-89

Description

The Slider Hero with Animation, Video Background & Intro Maker WordPress plugin before 8.2.7 does not sanitise or escape the id attribute of its hero-button shortcode before using it in a SQL statement, allowing users with a role as low as Contributor to perform SQL injection.

Affected products

quantumcloud Slider Hero with Video Background, Animation: before 8.2.7 — fixed in 8.2.7

How to fix

Upgrade to a fixed version: quantumcloud Slider Hero with Video Background, Animation 8.2.7. Check the vendor advisory for mitigations.

References

https://wpscan.com/vulnerability/52c8755c-46b9-4383-8c8d-8816f03456b0
https://wpscan.com/vulnerability/52c8755c-46b9-4383-8c8d-8816f03456b0

Get alerted when CVE-2021-24506 or the next vulnerability affects your stack