CVE-2021-24575: The School Management System – WPSchoolPress WordPress plugin before 2.1.10 does not properly sanitize or use prepared statements before using POST variable in SQL queries, leading to SQL injection in

high Affects wpschoolpress (WordPress plugin). Feed 2026.10.29.4, updated 2026-10-29; published 2021-11-08; advisory modified 2026-06-17.

The School Management System – WPSchoolPress WordPress plugin before 2.1.10 does not properly sanitize or use prepared statements before using POST variable in SQL queries, leading to SQL injection in

Package: wpschoolpress (WordPress plugin) WordPress
Affected versions: <2.1.10
Fixed in: 2.1.10
Severity: high CVSS 8.8
Exploitation: not on CISA KEV · EPSS 1% (71.7th percentile)
Published: 2021-11-08
Source: nvd

References

CWE-89

NVD record wpschoolpress (WordPress plugin) advisories

Am I affected?

Find out in one command. phpwarden checks your WordPress install against this advisory and 20,000+ others, ranked by real-world exploitation (CISA KEV + EPSS). Free, offline, open data.

# PHP projects (recommended)
composer require --dev phpwarden/phpwarden
# then
vendor/bin/phpwarden wordpress /var/www/html

# or, without Composer
pipx install phpwarden   &&   phpwarden wordpress /var/www/html

Or keep it checked automatically with the GitHub Action or a nightly cron; see WordPress docs.

Install docs How findings are ranked

Related advisories

CVE-2021-24664 medium The School Management System – WPSchoolPress WordPress plugin before 2.1.17 sanitise some same package: wpschoolpress (WordPress plugin)
CVE-2023-4776 high The School Management System WordPress plugin before 2.2.5 uses the WordPress esc_sql() fu same package: wpschoolpress (WordPress plugin)
CVE-2024-9637 high The School Management System – WPSchoolPress plugin for WordPress is vulnerable to privile same package: wpschoolpress (WordPress plugin)
CVE-2024-12332 medium The School Management System – WPSchoolPress plugin for WordPress is vulnerable to SQL Inj same package: wpschoolpress (WordPress plugin)
CVE-2025-1669 medium The School Management System – WPSchoolPress plugin for WordPress is vulnerable to SQL Inj same package: wpschoolpress (WordPress plugin)
CVE-2025-1670 medium The School Management System – WPSchoolPress plugin for WordPress is vulnerable to SQL Inj same package: wpschoolpress (WordPress plugin)