CVE-2021-24176

moderate-risk
Published 2021-04-05

The JH 404 Logger WordPress plugin through 1.1 doesn't sanitise the referer and path of 404 pages, when they are output in the dashboard, which leads to executing arbitrary JavaScript code in the WordPress dashboard.

Do I need to act?

!
37.0% chance of exploitation in next 30 days
EPSS score — higher than 63% of all CVEs
-
Not on CISA KEV list
No confirmed active exploitation reported to CISA
?
Patch status unknown
Check vendor advisories for fix availability and mitigation guidance
5
CVSS 5.4/10 Medium
NETWORK / LOW complexity

Affected Products (1)

Affected Vendors

Jh 404 Logger Project

References (4)

Exploit https://ganofins.com/blog/my-first-cve-2021-24176/
Exploit https://wpscan.com/vulnerability/705bcd6e-6817-4f89-be37-901a767b0585
Exploit https://ganofins.com/blog/my-first-cve-2021-24176/
Exploit https://wpscan.com/vulnerability/705bcd6e-6817-4f89-be37-901a767b0585
42
/ 100
moderate-risk
Severity 21/34 · High
Exploitability 16/34 · Moderate
Exposure 5/34 · Minimal