CVE-2021-33851

A cross-site scripting (XSS) attack can cause arbitrary code (JavaScript) to run in a user's browser and can use an application as the vehicle for the attack. The XSS payload given in the "Custom logo link" executes whenever the user opens the Settings Page of the "Customize Login Image" Plugin.

Affected

WordPress Customize Login Image Plugin

CVSS v3.1 NVD

5.4 MEDIUMCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

CVSS v2.0 NVD

3.5 LOWAV:N/AC:M/Au:S/C:N/I:P/A:N

EPSS

1.32% chance of exploitation in the next 30 days, 70th percentile

Nuclei

medium · CWE-79

Published

2022-03-09

Updated

2024-08-04

Nuclei templates (1)

• projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-33851.yaml

Security advisories

• https://cybersecurityworks.com/zerodays/cve-2021-33851-stored-cross-site-scripting-in-wor…

References

• CVE Record
• NVD entry