CVE-2021-24536

MEDIUM

Custom Login Redirect < 1.0.0 - Cross-Site Request Forgery and Stored Cross-Site Scripting

Title source: llm
STIX 2.1

Description

The Custom Login Redirect WordPress plugin through 1.0.0 does not have CSRF check in place when saving its settings, and do not sanitise or escape user input before outputting them back in the page, leading to a Stored Cross-Site Scripting issue

References (1)

Core 1
Core References
Exploit, Third Party Advisory x_refsource_misc
https://wpscan.com/vulnerability/e1ca9978-a44d-4717-b963-acaf56258fc9

Scores

CVSS v3 6.1
EPSS 0.0041
EPSS Percentile 33.1%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Details

CWE
CWE-352 CWE-79
Status published
Products (1)
custom_login_redirect_project/custom_login_redirect < 1.0.0
Published Aug 16, 2021
Tracked Since Feb 18, 2026