CVE-2021-34653

6.1 mediumEPSS 0.9%

Medium (6.1) in wp fountain project wp fountain. EPSS 0.9% chance of exploitation in the next 30 days.

The WP Fountain WordPress plugin is vulnerable to Reflected Cross-Site Scripting due to the use of $_SERVER['PHP_SELF'] in the ~/wp-fountain.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 1.5.9.

Severity

CVSS 3.1

6.1 medium

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

EPSS: 0.9% chance of exploitation in the next 30 days; higher than 59% of CVEs (scores of 2026-10-31)
CWE: CWE-79
Published: 2021-08-16
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

wp_fountain_project:wp_fountain

References

https://plugins.trac.wordpress.org/browser/wp-fountain/trunk/wp-fountain.php#L123
https://www.wordfence.com/vulnerability-advisories/#CVE-2021-34653
https://plugins.trac.wordpress.org/browser/wp-fountain/trunk/wp-fountain.php#L123
https://www.wordfence.com/vulnerability-advisories/#CVE-2021-34653

Check your stack JSON