What’s Vulnerable › Vulnerabilities

CVE-2021-24575: WPSchoolPress < 2.1.10 - Multiple Authenticated SQL Injections

• Severity: high (CVSS 8.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 1.4% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2021-11-08 · updated 2026-06-17
• Weakness: CWE-89

Description

The School Management System – WPSchoolPress WordPress plugin before 2.1.10 does not properly sanitize or use prepared statements before using POST variable in SQL queries, leading to SQL injection in multiple actions available to various authenticated users, from simple subscribers/students to teachers and above.

Affected products

• jdsofttech School Management System – WPSchoolPress: before 2.1.10 — fixed in 2.1.10

How to fix

Upgrade to a fixed version: jdsofttech School Management System – WPSchoolPress 2.1.10. Check the vendor advisory for mitigations.

References

• https://wpscan.com/vulnerability/83c9c3af-9eca-45e0-90d7-edc69e616e6a
• https://wpscan.com/vulnerability/83c9c3af-9eca-45e0-90d7-edc69e616e6a

Get alerted when CVE-2021-24575 or the next vulnerability affects your stack