CVE-2021-24626

Name: CVE-2021-24626
Creator: NVD / NIST
Published: 2021-11-08T18:15:08.38+00:00
License: https://creativecommons.org/publicdomain/zero/1.0/

HIGHCVSS 8.8/10EPSS 0.71%

Last modified Jun 17, 2026

CVE-2021-24626 is a high-severity vulnerability rated 8.8/10 on the CVSS scale. The Chameleon CSS WordPress plugin through 1.2 does not have any CSRF and capability checks in all its AJAX calls, allowing any authenticated user, such as subscriber to call them and perform unauthorised actions. One of AJAX call, remove_css, also does not sanitise or escape the css_id POST parameter before using it in a SQL statement, leading to a SQL Injection. EPSS estimates a 0.71% chance of exploitation in the next 30 days.

Description

The Chameleon CSS WordPress plugin through 1.2 does not have any CSRF and capability checks in all its AJAX calls, allowing any authenticated user, such as subscriber to call them and perform unauthorised actions. One of AJAX call, remove_css, also does not sanitise or escape the css_id POST parameter before using it in a SQL statement, leading to a SQL Injection

Metrics

CVSS 3.1

8.8/10

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

EPSS Probability

0.71%

48.9th percentile

Probability of exploitation in the next 30 days. Learn more

Weakness Enumeration

Affected Software

Vendor	Product	Versions
Chameleon Css Project	Chameleon Css	<= 1.2

References

https://codevigilant.com/disclosure/2021/wp-plugin-chameleon-css/Exploit, Third Party Advisory
https://wpscan.com/vulnerability/06cb6c14-99b8-45b6-be2e-f4dcca8a4165Exploit, Third Party Advisory
https://codevigilant.com/disclosure/2021/wp-plugin-chameleon-css/Exploit, Third Party Advisory
https://wpscan.com/vulnerability/06cb6c14-99b8-45b6-be2e-f4dcca8a4165Exploit, Third Party Advisory

Timeline

Published: Nov 8, 2021
Last Modified: Jun 17, 2026
Status: Modified

Frequently Asked Questions

What is CVE-2021-24626?

How severe is CVE-2021-24626?

CVE-2021-24626 has a CVSS score of 8.8/10 (HIGH severity). The EPSS model estimates a 0.71% probability of exploitation in the next 30 days.

How do I fix CVE-2021-24626?

Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.

Are you affected by CVE-2021-24626?

Run a free Strix scan to check your systems for this vulnerability.

Scan your code now

Source: NVD / NIST