CVE-2021-24176

The JH 404 Logger WordPress plugin through 1.1 doesn't sanitise the referer and path of 404 pages, when they are output in the dashboard, which leads to executing arbitrary JavaScript code in the WordPress dashboard.
Cross-site Scripting
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTNIST
5.4 MEDIUM
NETWORK
LOW
LOW
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
WPScanCNA
---
---
CVEADP
---
---
Base Score
CVSS 3.x
EPSS Score
Percentile: 95%
VendorProductVersion
jh_404_logger_projectjh_404_logger
𝑥
≤ 1.1
𝑥
= Vulnerable software versions
Common Weakness Enumeration
References
https://ganofins.com/blog/my-first-cve-2021-24176/
https://wpscan.com/vulnerability/705bcd6e-6817-4f89-be37-901a767b0585
https://ganofins.com/blog/my-first-cve-2021-24176/
https://wpscan.com/vulnerability/705bcd6e-6817-4f89-be37-901a767b0585