Skip to content
Sign in
Not rated

CVE-2021-24461 The get_faqs() function in the FAQ Builder AYS WordPress plugin before 1.3.6 did not use whitelist or validate the…

Description

The get_faqs() function in the FAQ Builder AYS WordPress plugin before 1.3.6 did not use whitelist or validate the orderby parameter before using it in SQL statements passed to the get_results() DB calls, leading to SQL injection issues in the admin dashboard

Affected products and versions

Product Affected versions Fixed in
FAQ Builder AYS 1.3 earliest → < 1.3.6 1.3.6

Other CVEs of FAQ Builder AYS

The 3 CVEs of FAQ Builder AYS →
CVE-2026-25346 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Ays Pro FAQ… 7.1 High CVE-2025-24722 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Ays Pro FAQ… 5.9 Medium
Track this CVE