Vulnerability · Published Apr 5, 2021 · Assigned by WPScan
CVE-2021-24176JH 404 Logger <= 1.1 - Unauthenticated Stored Cross-Site Scripting (XSS)
Medium 5.4
In plain English
A medium-severity cross-site scripting in JH 404 Logger from Unknown. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 2.0% (higher than 81% of all known vulnerabilities). Ready-made attack tooling exists: Nuclei.
Severity (CVSS NVD)5.4Medium
Exploit odds (30 days)2.0%top 18.8% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack tooling1Nuclei
Official description
The JH 404 Logger WordPress plugin through 1.1 doesn't sanitise the referer and path of 404 pages, when they are output in the dashboard, which leads to executing arbitrary JavaScript code in the WordPress dashboard.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Unknown | JH 404 Logger | 1.1 – through 1.1 |
Weakness: CWE-79
References
- https://wpscan.com/vulnerability/705bcd6e-6817-4f89-be37-901a767b0585 x_refsource_CONFIRM
- https://ganofins.com/blog/my-first-cve-2021-24176/ x_refsource_MISC