CVE-2021-4227
Ark Comment Editor <= 2.15.6 - Iframe Injection via Comment
- State
- Published
- Severity
- 5.3 Medium
- Published
- Jan 16, 2024
- Updated
- Jun 2, 2025
- Reserved
- Apr 29, 2022
Description
The ark-commenteditor WordPress plugin through 2.15.6 does not properly sanitise or encode the comments when in Source editor, allowing attackers to inject an iFrame in the page and thus load arbitrary content from any page to the comment section
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 3.1 | 5.3 Medium | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N | CISA-ADP |
Weaknesses
The record names no weakness.
Affected Products
| Product | Versions |
|---|---|
ark-commenteditorUnknown |
|
References
- https://wpscan.com/vulnerability/8d015eba-31dc-44cb-a051-4e95df782b75/exploitvdb-entrytechnical-description
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.