What’s Vulnerable › Vulnerabilities

CVE-2021-4227: Ark Comment Editor <= 2.15.6 - Iframe Injection via Comment

• Severity: medium (CVSS 5.3 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.6% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2024-01-16 · updated 2026-06-17
• Weakness: CWE-74

Description

The ark-commenteditor WordPress plugin through 2.15.6 does not properly sanitise or encode the comments when in Source editor, allowing attackers to inject an iFrame in the page and thus load arbitrary content from any page to the comment section

Affected products

• ark-commenteditor: through 2.15.6

References

• https://wpscan.com/vulnerability/8d015eba-31dc-44cb-a051-4e95df782b75/
• https://wpscan.com/vulnerability/8d015eba-31dc-44cb-a051-4e95df782b75/

Get alerted when CVE-2021-4227 or the next vulnerability affects your stack