VULNERABILITY INTELLIGENCE

CVE-2021-33851

CVSS score5.4 MEDIUM

EPSS probability1.32%

CISA KEVNot currently listed

Published2022-03-10

Last modified2026-06-17

CVSS vectorCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Description

A cross-site scripting (XSS) attack can cause arbitrary code (JavaScript) to run in a user's browser and can use an application as the vehicle for the attack. The XSS payload given in the "Custom logo link" executes whenever the user opens the Settings Page of the "Customize Login Image" Plugin.

Weakness classification

disclose@cybersecurityworks.com: CWE-79
nvd@nist.gov: CWE-79

Primary references

disclose@cybersecurityworks.com — Exploit, Mitigation, Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108 — Exploit, Mitigation, Third Party Advisory