CVE-2021-24857

CRITICAL 9.8CVE-2021-24857 · Published 13/12/2021 · updated 17/06/2026

In short

CVE-2021-24857 is a CRITICAL (CVSS 9.8) vulnerability affecting totop link (nocean).
Chance of exploitation in the next 30 days (EPSS): 1.9%, higher than 79.8% of all vulnerabilities.
No patched version is listed yet: follow the vendor's advisory in References.

Package	Affected versions	Patched versions
totop link nocean	`≤ 1.7.1`	No fix yet

Description

The ToTop Link WordPress plugin through 1.7.1 passes base64 encoded user input to the unserialize() PHP function, which could lead to PHP Object injection if a plugin installed on the blog has a suitable gadget chain.

References

wpscan.com/vulnerability/518204d8-fbf5-4bfa-9db5-835f908f8d8e · Exploit

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free