Description
A cross-site scripting (XSS) attack can cause arbitrary code (JavaScript) to run in a user's browser and can use an application as the vehicle for the attack. The XSS payload given in the "Custom logo link" executes whenever the user opens the Settings Page of the "Customize Login Image" Plugin.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| — | WordPress Customize Login Image Plugin | Version 3.4 | — |
Automated scanner template
A ready-made Nuclei template detects this vulnerability automatically. Vulnerabilities with public scanner templates are typically probed across the internet soon after the template appears — exposed systems should be patched first.
- WordPress Customize Login Image <3.5.3 - Cross-Site Scripting http/cves/2021/CVE-2021-33851.yaml
Source: projectdiscovery/nuclei-templates (MIT) — updated daily. Only links are listed.