CVE-2021-33851

A cross-site scripting (XSS) attack can cause arbitrary code (JavaScript) to run in a user's browser and can use an application as the vehicle for the attack. The XSS payload given in the "Custom logo link" executes whenever the user opens the Settings Page of the "Customize Login Image" Plugin.

CVSS v3.1

5.4 MEDIUMCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

CVSS v2.0

3.5 LOWAV:N/AC:M/Au:S/C:N/I:P/A:N

EPSS

1.32% chance of exploitation in the next 30 days, 69th percentile

Nuclei

medium · CWE-79

Published

2022-03-09

Updated

2024-08-04

Nuclei templates (1)

• projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-33851.yaml

References

• CVE Record
• NVD entry

Related

• CVE-2021-33839
• CVE-2021-33879
• CVE-2021-33833
• CVE-2021-33887
• CVE-2021-33831
• CVE-2021-33904