CVE-2021-24756CWE-79

WP System Log < 1.0.21 - Unauthenticated Stored Cross-Site Scripting

published December 13, 2021

CVSS
—
EPSS
1%
Percentile
71.1
In the wild
Unconfirmed
What it is

The WP System Log WordPress plugin before 1.0.21 does not sanitise, validate and escape the IP address retrieved from login requests before outputting them in the admin dashboard, which could allow unauthenticated attacker to perform Cross-Site Scripting attacks against admins viewing the logs.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.01343 · 71.1th percentile
Weakness
CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Published
2021-12-13T10:40Z
EPSS history
Timeline
  • 13 DEC 10:40Z
    WP System Log < 1.0.21 - Unauthenticated Stored Cross-Site Scripting
    cvelistv5