CVE-2021-24214

PoC —

CVSS 3.1

6.1 medium

EPSS

2%p75

Published

May 6, 2021 (May 6, 2021)

Modified

Jun 17, 2026

Description

The OpenID Connect Generic Client WordPress plugin 3.8.0 and 3.8.1 did not sanitise the login error when output back in the login form, leading to a reflected Cross-Site Scripting issue. This issue does not require authentication and can be exploited with the default configuration.

Vendors: daggerhartlab
Products: openid connect generic client
Ecosystems: WordPress
Weakness: CWE-79
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

NVD CVE.org GitHub PoCs EPSS (1.6%)

In the news0 stories

No ingested article mentions this CVE yet.