CVE-2021-33851

5.4 mediumEPSS 1.3%

Medium (5.4) in apasionados customize login image. EPSS 1.3% chance of exploitation in the next 30 days.

A cross-site scripting (XSS) attack can cause arbitrary code (JavaScript) to run in a user's browser and can use an application as the vehicle for the attack. The XSS payload given in the "Custom logo link" executes whenever the user opens the Settings Page of the "Customize Login Image" Plugin.

Severity

CVSS 3.1

5.4 medium

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

EPSS: 1.3% chance of exploitation in the next 30 days; higher than 70% of CVEs (scores of 2026-10-31)
CWE: CWE-79
Published: 2022-03-10
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

apasionados:customize_login_image

References

https://cybersecurityworks.com/zerodays/cve-2021-33851-stored-cross-site-scripting-in-wordpress-customize-login-image.html
https://cybersecurityworks.com/zerodays/cve-2021-33851-stored-cross-site-scripting-in-wordpress-customize-login-image.html

Check your stack JSON