The set includes an SQL injection on WP_Query ... and most WordPress sites that use the default automatic core updates setting aren't in danger. However, sites using WordPress 5.8.2 or older ...