Vulnerability Description
The JH 404 Logger WordPress plugin through 1.1 doesn't sanitise the referer and path of 404 pages, when they are output in the dashboard, which leads to executing arbitrary JavaScript code in the WordPress dashboard.
CVSS Score
MEDIUM
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Jh 404 Logger Project | Jh 404 Logger | <= 1.1 |
Related Weaknesses (CWE)
References
- https://ganofins.com/blog/my-first-cve-2021-24176/ExploitThird Party Advisory
- https://wpscan.com/vulnerability/705bcd6e-6817-4f89-be37-901a767b0585ExploitThird Party Advisory
- https://ganofins.com/blog/my-first-cve-2021-24176/ExploitThird Party Advisory
- https://wpscan.com/vulnerability/705bcd6e-6817-4f89-be37-901a767b0585ExploitThird Party Advisory
FAQ
What is CVE-2021-24176?
CVE-2021-24176 is a vulnerability with a CVSS score of 5.4 (MEDIUM). The JH 404 Logger WordPress plugin through 1.1 doesn't sanitise the referer and path of 404 pages, when they are output in the dashboard, which leads to executing arbitrary JavaScript code in the Word...
How severe is CVE-2021-24176?
CVE-2021-24176 has been rated MEDIUM with a CVSS base score of 5.4/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2021-24176?
Check the references section above for vendor advisories and patch information. Affected products include: Jh 404 Logger Project Jh 404 Logger.