CVE-2021-24756

6.1 mediumEPSS 1.3%

Medium (6.1) in wp system log project wp system log. EPSS 1.3% chance of exploitation in the next 30 days.

The WP System Log WordPress plugin before 1.0.21 does not sanitise, validate and escape the IP address retrieved from login requests before outputting them in the admin dashboard, which could allow unauthenticated attacker to perform Cross-Site Scripting attacks against admins viewing the logs.

Severity

CVSS 3.1

6.1 medium

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

EPSS: 1.3% chance of exploitation in the next 30 days; higher than 71% of CVEs (scores of 2026-10-31)
CWE: CWE-79
Published: 2021-12-13
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

wp_system_log_project:wp_system_log

References

https://wpscan.com/vulnerability/0cea0717-8f54-4f1c-b3ee-aff7dd91bf59
https://wpscan.com/vulnerability/0cea0717-8f54-4f1c-b3ee-aff7dd91bf59

Check your stack JSON