CVE-2021-24658

The Erident Custom Login and Dashboard WordPress plugin before 3.5.9 did not properly sanitise its settings, allowing high privilege users to use XSS payloads in them (even when the unfileted_html is disabled)

CVSS v3.1

4.8 MEDIUMCVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

CVSS v2.0

3.5 LOWAV:N/AC:M/Au:S/C:N/I:P/A:N

EPSS

0.68% chance of exploitation in the next 30 days, 50th percentile

Published

2021-08-23

Updated

2024-08-03

Proof-of-concept exploits (1)

• https://wpscan.com/vulnerability/ec70f02b-02a1-4511-949e-68f2d9d37ca8

References

• CVE Record
• NVD entry

Related

• CVE-2021-24657
• CVE-2021-24662
• CVE-2021-24656
• CVE-2021-24663
• CVE-2021-24655
• CVE-2021-24664