CVE-2021-24326: All 404 Redirect to Homepage < 1.21 - Authenticated Reflected Cross-Site Scripting (XSS)
Vulnerability summary
CVE-2021-24326 is a medium (CVSS 6.1) Cross-site Scripting vulnerability in clogica all_404_redirect_to_homepage. EPSS estimates a 0.62% chance of exploitation in the next 30 days, higher than 49% of scored vulnerabilities. 1 public exploit is recorded.
Timeline
- 17-05-2021PublishedVulnerability first disclosed.
- 03-08-2024Last modifiedVulnerability information updated.
Description
The tab parameter of the settings page of the All 404 Redirect to Homepage WordPress plugin before 1.21 was vulnerable to an authenticated reflected Cross-Site Scripting (XSS) issue as user input was not properly sanitised before being output in an attribute.
CVSS metrics
3 scores · 2 sources · 2 versions- NVDNIST5.4MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:NDiffers
EPSS trend
Probability
0.62%
Chance of exploitation in the next 30 days
Percentile
49%
Versus all other CVEs
30-day change
No change 0.00 pp
From 0.62% on 22-09-2026
Known exploited
Compare KEV catalogs
CISA KEVNot in the CISA KEV catalog.
ENISA CNWNot in the ENISA CNW catalog.
CIRCLNot in the CIRCL catalog.
Public exploits
1 foundExploit Reference (wpscan.com)
Maturity: unknown
Weaknesses
CWE · root causeAffected systems
Clogica1 product
Unknown1 product
- all 404 redirect to homepage≥ 1.21, < 1.21
Wordpress1 product
- all-404-redirect-to-homepage< 1.21
3 vendors · 3 products
References
2 links- wpscan.com/vulnerability/63d6ca03-e0df-40db-9839-531c13619094X Refsource CONFIRMExploitThird Party Advisory