{"id":"CVE-2021-24481","url":"https://www.cyber-defence.io/tools/cve/CVE-2021-24481","generatedAt":"2026-10-27T22:25:23.162Z","title":"The Any Hostname WordPress plugin through 1.0.6 does not sanitise or escape its \"Allowed hosts\" setting, leading to an authenticated stored XSS issue as high privilege users are able to set XSS payloads in it","description":"The Any Hostname WordPress plugin through 1.0.6 does not sanitise or escape its \"Allowed hosts\" setting, leading to an authenticated stored XSS issue as high privilege users are able to set XSS payloads in it","published":"2021-08-02T11:15:11.000Z","lastModified":"2026-06-17T03:40:06.000Z","status":"Modified","sourceIdentifier":"contact@wpscan.com","cvss":{"version":"3.1","score":4.8,"severity":"MEDIUM","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N"},"cwe":["CWE-79"],"affected":["any hostname project/any hostname"],"epss":{"score":0.00613,"percentile":0.49088,"date":"2026-10-26","history":[]},"kev":{"listed":false},"exploits":{"count":0,"verified":false,"firstPublished":null,"source":"Exploit-DB (https://gitlab.com/exploit-database/exploitdb)","entries":[]},"verdict":{"level":"low","text":"Lower severity and a low EPSS score (0.61%). Track it; it rarely justifies an emergency change on its own."},"changes":[],"references":[{"url":"https://wpscan.com/vulnerability/a4c352de-9815-4dfe-ac51-65b5bfb37438","tags":["Exploit","Third Party Advisory"],"source":"contact@wpscan.com"},{"url":"https://wpscan.com/vulnerability/a4c352de-9815-4dfe-ac51-65b5bfb37438","tags":["Exploit","Third Party Advisory"],"source":"af854a3a-2127-422b-91ae-364da2661108"}],"sources":{"nvd":"https://nvd.nist.gov/vuln/detail/CVE-2021-24481","epss":"https://www.first.org/epss/","kev":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","exploitdb":"https://www.exploit-db.com/"},"licence":"CC BY 4.0 — link back to the CVE Explorer if you publish the results; upstream data remains subject to its own terms."}