CVE-2021-47860

MediumCVSS 4.3/10Last modified Jun 17, 2026

Description

GetSimple CMS Custom JS 0.1 plugin contains a cross-site request forgery vulnerability that allows unauthenticated attackers to inject arbitrary client-side code into administrator browsers. Attackers can craft a malicious website that triggers a cross-site scripting payload to execute remote code on the hosting server when an authenticated administrator visits the page.

Metrics

CVSS 3.1 4.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

Weakness enumeration

CWE-352

Affected software

Vendor	Product	Versions
GetSimple CMS	Custom JS Plugin	0.1

References

http://get-simple.infoProduct
https://github.com/GetSimpleCMS/GetSimpleCMSProduct
https://github.com/boku7/gsCMS-CustomJS-Csrf2Xss2RceExploit, Third Party Advisory
https://www.exploit-db.com/exploits/49712Exploit, Third Party Advisory, VDB Entry
https://www.exploit-db.com/exploits/49816Exploit, Third Party Advisory, VDB Entry
https://www.vulncheck.com/advisories/getsimple-cms-custom-js-csrf-to-xss-to-rceThird Party Advisory

Timeline

Published: Jan 21, 2026
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2021

CVE-2021-478617.8Event Log Explorer 4.9.3 contains an unquoted service path vulnerability that allows local users to potentially execute arbitrary code with CVE-2021-478627.8Hi-Rez Studios 5.1.6.3 contains an unquoted service path vulnerability in the HiPatchService that allows local attackers to execute code wit CVE-2021-478637.8MacPaw Encrypto 1.0.1 contains an unquoted service path vulnerability in its Encrypto Service configuration that allows local attackers to p CVE-2021-478647.8OSAS Traverse Extension 11 contains an unquoted service path vulnerability in the TravExtensionHostSvc service running with LocalSystem priv CVE-2021-478657.5ProFTPD 1.3.7a contains a denial of service vulnerability that allows attackers to overwhelm the server by creating multiple simultaneous FT CVE-2021-478667.8WIN-PACK PRO 4.8 contains an unquoted service path vulnerability in the GuardTourService that allows local users to potentially execute code CVE-2021-478677.8WIN-PACK PRO4.8 contains an unquoted service path vulnerability in the ScheduleService that allows local users to potentially execute code w CVE-2021-478687.8WIN-PACK PRO 4.8 contains an unquoted service path vulnerability in the WPCommandFileService that allows local users to potentially execute CVE-2021-478697.8Brother BRAdmin Professional 3.75 contains an unquoted service path vulnerability in the BRA_Scheduler service that allows local users to po CVE-2021-478705.4GetSimple CMS My SMTP Contact Plugin 1.1.2 suffers from a Stored Cross-Site Scripting (XSS) vulnerability. The plugin attempts to sanitize u CVE-2021-478718.8Hestia Control Panel 1.3.2 contains an arbitrary file write vulnerability that allows authenticated attackers to write files to arbitrary lo CVE-2021-478727.1SEO Panel versions prior to 4.9.0 contain a blind SQL injection vulnerability in the archive.php page that allows authenticated attackers to