CVE-2021-24557

HIGH 7.2CVE-2021-24557 · Published 23/08/2021 · updated 17/06/2026

In short

CVE-2021-24557 is a HIGH (CVSS 7.2) vulnerability affecting m-vslider (nimble3).
Chance of exploitation in the next 30 days (EPSS): 1.5%, higher than 75.2% of all vulnerabilities.
No patched version is listed yet: follow the vendor's advisory in References.

Package	Affected versions	Patched versions
m-vslider nimble3	`≤ 2.1.3`	No fix yet

Description

The update functionality in the rslider_page uses an rs_id POST parameter which is not validated, sanitised or escaped before being inserted in sql query, therefore leading to SQL injection for users having Administrator role.

References

codevigilant.com/disclosure/2021/wp-plugin-m-vslider · Exploit
wpscan.com/vulnerability/8b8e41e8-5a40-4062-b5b7-3b01b1a709ef · Exploit

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free