CVE-2021-24550

The Broken Link Manager WordPress plugin through 0.6.5 does not sanitise, validate or escape the url GET parameter before using it in a SQL statement when retrieving an URL to edit, leading to an authenticated SQL injection issue

• CWE-89

• https://codevigilant.com/disclosure/2021/wp-plugin-broken-link-manager/Exploit, Third Party Advisory
• https://wpscan.com/vulnerability/1bf65448-689c-474d-a566-c9b6797d3e4aExploit, Third Party Advisory
• https://codevigilant.com/disclosure/2021/wp-plugin-broken-link-manager/Exploit, Third Party Advisory
• https://wpscan.com/vulnerability/1bf65448-689c-474d-a566-c9b6797d3e4aExploit, Third Party Advisory

Published

Aug 23, 2021

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2021-24545The WP HTML Author Bio WordPress plugin through 1.2.0 does n…5.4
• CVE-2021-24546The Gutenberg Block Editor Toolkit – EditorsKit WordPress pl…8.8
• CVE-2021-24547The KN Fix Your Title WordPress plugin through 1.0.1 was vul…5.4
• CVE-2021-24548The Mimetic Books WordPress plugin through 0.2.13 was vulner…5.4
• CVE-2021-24549The AceIDE WordPress plugin through 2.6.2 does not sanitise …4.9
• CVE-2021-2455Vulnerability in the PeopleSoft Enterprise HCM Shared Compon…6.5
• CVE-2021-24551The Edit Comments WordPress plugin through 0.3 does not sani…9.8
• CVE-2021-24552The Simple Events Calendar WordPress plugin through 1.4.0 do…7.2
• CVE-2021-24553The Timeline Calendar WordPress plugin through 1.2 does not …7.2
• CVE-2021-24554The Paytm – Donation Plugin WordPress plugin through 1.3.2 d…7.2
• CVE-2021-24555The daac_delete_booking_callback function, hooked to the daa…8.8
• CVE-2021-24556The kento_email_subscriber_ajax AJAX action of the Email Sub…6.1