CVE-2021-24176

MediumCVSS 5.4/10Last modified Jun 17, 2026

Description

The JH 404 Logger WordPress plugin through 1.1 doesn't sanitise the referer and path of 404 pages, when they are output in the dashboard, which leads to executing arbitrary JavaScript code in the WordPress dashboard.

Metrics

CVSS 3.1 5.4/10CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

Vendor	Product	Versions
Unknown	JH 404 Logger	>= 1.1, <= 1.1

References

https://ganofins.com/blog/my-first-cve-2021-24176/Exploit, Third Party Advisory
https://wpscan.com/vulnerability/705bcd6e-6817-4f89-be37-901a767b0585Exploit, Third Party Advisory
https://ganofins.com/blog/my-first-cve-2021-24176/Exploit, Third Party Advisory
https://wpscan.com/vulnerability/705bcd6e-6817-4f89-be37-901a767b0585Exploit, Third Party Advisory

Timeline

Published: Apr 5, 2021
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2021

CVE-2021-241775.4In the default configuration of the File Manager WordPress plugin before 7.1, a Reflected XSS can occur on the endpoint /wp-admin/admin.php?CVE-2021-241788.8The Business Directory Plugin – Easy Listing Directories for WordPress WordPress plugin before 5.11.1 suffered from Cross-Site Request Forge CVE-2021-241798.8The Business Directory Plugin – Easy Listing Directories for WordPress WordPress plugin before 5.11 suffered from a Cross-Site Request Forge CVE-2021-24184.9Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 8.0.25 an CVE-2021-241805.4Unvalidated input and lack of output encoding within the Related Posts for WordPress plugin before 2.0.4 lead to a Reflected Cross-Site Scri CVE-2021-241816.5The tutor_mark_answer_as_correct AJAX action from the Tutor LMS – eLearning and online course solution WordPress plugin before 1.7.7 was vul CVE-2021-241826.5The tutor_quiz_builder_get_answers_by_question AJAX action from the Tutor LMS – eLearning and online course solution WordPress plugin before CVE-2021-241836.5The tutor_quiz_builder_get_question_form AJAX action from the Tutor LMS – eLearning and online course solution WordPress plugin before 1.8.3 CVE-2021-241848.8Several AJAX endpoints in the Tutor LMS – eLearning and online course solution WordPress plugin before 1.7.7 were unprotected, allowing stud CVE-2021-241856.5The tutor_place_rating AJAX action from the Tutor LMS – eLearning and online course solution WordPress plugin before 1.7.7 was vulnerable to CVE-2021-241866.5The tutor_answering_quiz_question/get_answer_by_id function pair from the Tutor LMS – eLearning and online course solution WordPress plugin CVE-2021-241875.4The setting page of the SEO Redirection Plugin - 301 Redirect Manager WordPress plugin before 6.4 is vulnerable to reflected Cross-Site Scri