CVE-2021-24587

PoC —

CVSS 3.1

5.4 medium

EPSS

<1%p48

Published

Sep 20, 2021 (Sep 20, 2021)

Modified

Jun 17, 2026

Description

The Splash Header WordPress plugin before 1.20.8 doesn't sanitise and escape some of its settings while outputting them in the admin dashboard, leading to an authenticated Stored Cross-Site Scripting issue.

Vendors: zeesweb
Products: splash header
Ecosystems: WordPress
Weakness: CWE-79
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

NVD CVE.org GitHub PoCs EPSS (0.6%)

In the news0 stories

No ingested article mentions this CVE yet.