CVE-2021-33851CWE-79

A cross-site scripting (XSS) attack can cause arbitrary code (JavaScript) to run in a user's browser and can use an application as the vehicle for the attack

published March 9, 2022

CVSS
—
EPSS
1%
Percentile
70.6
In the wild
Unconfirmed
What it is

A cross-site scripting (XSS) attack can cause arbitrary code (JavaScript) to run in a user's browser and can use an application as the vehicle for the attack. The XSS payload given in the "Custom logo link" executes whenever the user opens the Settings Page of the "Customize Login Image" Plugin.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.01318 · 70.6th percentile
Weakness
CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Published
2022-03-09T16:54Z
EPSS history
Timeline
  • 09 MAR 16:54Z
    A cross-site scripting (XSS) attack can cause arbitrary code (JavaScript) to run in a user's browser and can use an application as the vehicle for the attack
    cvelistv5