CVE-2021-24214

MEDIUM NUCLEI

Daggerhartlab Openid Connect Generic Client - XSS

Title source: rule

Description

The OpenID Connect Generic Client WordPress plugin 3.8.0 and 3.8.1 did not sanitise the login error when output back in the login form, leading to a reflected Cross-Site Scripting issue. This issue does not require authentication and can be exploited with the default configuration.

Nuclei Templates (1)

WordPress OpenID Connect Generic Client 3.8.0-3.8.1 - Cross-Site Scripting

MEDIUMVERIFIEDby tess

References (1)

[Exploit, Third Party Advisory] https://wpscan.com/vulnerability/31cf0dfb-4025-4898-a5f4-fc7115565a10

Scores

CVSS v3 6.1

EPSS 0.0404

EPSS Percentile 88.5%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Details

CWE

CWE-79

Status published

Products (2)

daggerhartlab/openid_connect_generic_client 3.8.0

daggerhartlab/openid_connect_generic_client 3.8.1

Published May 06, 2021

Tracked Since Feb 18, 2026