blogsafe.org My Downloads

BlogSafe.org

WordPress CVEs

Search and review WordPress-related vulnerability records.

← Back to CVE list

CVE-2021-24176

MEDIUM 5.4 CVSS 3.1
Published
April 5, 2021
Last modified
June 17, 2026
NVD status
Modified
Reported by
contact@wpscan.com
Weakness
CWE-79
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Description

The JH 404 Logger WordPress plugin through 1.1 doesn't sanitise the referer and path of 404 pages, when they are output in the dashboard, which leads to executing arbitrary JavaScript code in the WordPress dashboard.

Affected products and versions

  • Unknown JH 404 Logger — From 1.1 (including) to 1.1 (including)
  • jh_404_logger_project jh_404_logger — Up to and including 1.1

References

  • ganofins.com https://ganofins.com/blog/my-first-cve-2021-24176/ Exploit, Third Party Advisory
  • wpscan.com https://wpscan.com/vulnerability/705bcd6e-6817-4f89-be37-901a767b0585 Exploit, Third Party Advisory
  • nvd.nist.gov Official NVD record