CVE-2021-24481

PoC —

CVSS 3.1

4.8 medium

EPSS

<1%p48

Published

Aug 2, 2021 (Aug 2, 2021)

Modified

Jun 17, 2026

Description

The Any Hostname WordPress plugin through 1.0.6 does not sanitise or escape its "Allowed hosts" setting, leading to an authenticated stored XSS issue as high privilege users are able to set XSS payloads in it

Vendors: any hostname project
Products: any hostname
Ecosystems: WordPress
Weakness: CWE-79
Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

NVD CVE.org GitHub PoCs EPSS (0.6%)

In the news0 stories

No ingested article mentions this CVE yet.