CVE-2021-24481

The Any Hostname WordPress plugin through 1.0.6 does not sanitise or escape its "Allowed hosts" setting, leading to an authenticated stored XSS issue as high privilege users are able to set XSS payloads in it

CVSS v3.1

4.8 MEDIUMCVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

CVSS v2.0

3.5 LOWAV:N/AC:M/Au:S/C:N/I:P/A:N

EPSS

0.61% chance of exploitation in the next 30 days, 47th percentile

Published

2021-08-02

Updated

2024-08-03

Proof-of-concept exploits (1)

• https://wpscan.com/vulnerability/a4c352de-9815-4dfe-ac51-65b5bfb37438

References

• CVE Record
• NVD entry

Related

• CVE-2021-24480
• CVE-2021-24482
• CVE-2021-24479
• CVE-2021-24483
• CVE-2021-24478
• CVE-2021-24484