{"id":"CVE-2021-4227","url":"https://www.cyber-defence.io/tools/cve/CVE-2021-4227","generatedAt":"2026-10-27T17:45:52.431Z","title":"The ark-commenteditor WordPress plugin through 2.15.6 does not properly sanitise or encode the comments when in Source editor, allowing attackers to inject an iFrame in the page and thus load arbitrary content from any page to the comment section","description":"The ark-commenteditor WordPress plugin through 2.15.6 does not properly sanitise or encode the comments when in Source editor, allowing attackers to inject an iFrame in the page and thus load arbitrary content from any page to the comment section","published":"2024-01-16T16:15:09.000Z","lastModified":"2026-06-17T04:19:18.000Z","status":"Modified","sourceIdentifier":"contact@wpscan.com","cvss":{"version":"3.1","score":5.3,"severity":"MEDIUM","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"},"cwe":["CWE-74"],"affected":["obg/ark wysiwyg comment editor"],"epss":{"score":0.00608,"percentile":0.48825,"date":"2026-10-26","history":[]},"kev":{"listed":false},"exploits":{"count":0,"verified":false,"firstPublished":null,"source":"Exploit-DB (https://gitlab.com/exploit-database/exploitdb)","entries":[]},"verdict":{"level":"low","text":"Lower severity and a low EPSS score (0.61%). Track it; it rarely justifies an emergency change on its own."},"changes":[],"references":[{"url":"https://wpscan.com/vulnerability/8d015eba-31dc-44cb-a051-4e95df782b75/","tags":["Exploit","Third Party Advisory"],"source":"contact@wpscan.com"},{"url":"https://wpscan.com/vulnerability/8d015eba-31dc-44cb-a051-4e95df782b75/","tags":["Exploit","Third Party Advisory"],"source":"af854a3a-2127-422b-91ae-364da2661108"}],"sources":{"nvd":"https://nvd.nist.gov/vuln/detail/CVE-2021-4227","epss":"https://www.first.org/epss/","kev":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","exploitdb":"https://www.exploit-db.com/"},"licence":"CC BY 4.0 — link back to the CVE Explorer if you publish the results; upstream data remains subject to its own terms."}