CVEvulnerability
CVE-2021-24176
5.4 MEDIUM
Official page ↗
- Status
- Modified
- Published
- 2021-04-05
- Last modified
- 2026-06-17
- Assigner
- [email protected]
- CVSS 3.1 ([email protected])
- 5.4 MEDIUM — CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
- CVSS 2.0 ([email protected])
- 3.5 LOW — AV:N/AC:M/Au:S/C:N/I:P/A:N
- Weaknesses
- CWE-79
Description
The JH 404 Logger WordPress plugin through 1.1 doesn't sanitise the referer and path of 404 pages, when they are output in the dashboard, which leads to executing arbitrary JavaScript code in the WordPress dashboard.
Affected configurations
• jh 404 logger project jh 404 logger (<= 1.1)
Related
Weakness · CWE (1)
- CWE-79 Improper Neutralization of Input During Web Page Generation weakness
References
- https://ganofins.com/blog/my-first-cve-2021-24176/ Exploit, Third Party Advisory
- https://wpscan.com/vulnerability/705bcd6e-6817-4f89-be37-901a767b0585 Exploit, Third Party Advisory
- https://ganofins.com/blog/my-first-cve-2021-24176/ Exploit, Third Party Advisory
- https://wpscan.com/vulnerability/705bcd6e-6817-4f89-be37-901a767b0585 Exploit, Third Party Advisory