CVE-2021-24283

5.4 mediumEPSS 0.6%

Medium (5.4) in pickplugins accordion. EPSS 0.6% chance of exploitation in the next 30 days.

The tab GET parameter of the settings page is not sanitised or escaped when being output back in an HTML attribute, leading to a reflected XSS issue.

Severity

5.4 medium

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

EPSS: 0.6% chance of exploitation in the next 30 days; higher than 49% of CVEs (scores of 2026-10-31)
CWE: CWE-79
Published: 2021-05-14
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19