CVE-2021-24328: WP Login Security and History <= 1.0 - CSRF to Stored Cross-Site Scripting (XSS)
Vulnerability summary
CVE-2021-24328 is a high (CVSS 8.8) Cross-site Scripting vulnerability in clogica wp_login_security_and_history. EPSS estimates a 0.61% chance of exploitation in the next 30 days, higher than 48.7% of scored vulnerabilities. 3 public exploits are recorded.
Timeline
- 01-06-2021PublishedVulnerability first disclosed.
- 03-08-2024Last modifiedVulnerability information updated.
Description
The WP Login Security and History WordPress plugin through 1.0 did not have CSRF check when saving its settings, not any sanitisation or validation on them. This could allow attackers to make logged in administrators change the plugin's settings to arbitrary values, and set XSS payloads on them as well
CVSS metrics
3 scores · 2 sources · 2 versions- NVDNIST6.2MediumCVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:N/I:H/A:NDiffers
EPSS trend
Probability
0.61%
Chance of exploitation in the next 30 days
Percentile
49%
Versus all other CVEs
30-day change
No change 0.00 pp
From 0.61% on 22-09-2026
Known exploited
Compare KEV catalogs
CISA KEVNot in the CISA KEV catalog.
ENISA CNWNot in the ENISA CNW catalog.
CIRCLNot in the CIRCL catalog.
Public exploits
3 foundExploit Reference (wpscan.com)
Maturity: unknown
Exploit Reference (m0ze.ru)
Maturity: unknown
Exploit Reference (m0ze.ru)
Maturity: unknown
Weaknesses
CWE · root cause- CWE-79Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
- CWE-352Cross-Site Request Forgery (CSRF)The web application does not, or cannot, sufficiently verify whether a request was intentionally provided by the user who sent the request, which could have originated from an unauthorized actor.
Affected systems
Clogica1 product
Unknown1 product
Wordpress1 product
- wp-login-security-and-history≤ 1.0
3 vendors · 3 products
References
5 links- wpscan.com/vulnerability/eeb41d7b-8f9e-4a12-b65f-f310f08e4aceX Refsource CONFIRMExploitThird Party Advisory
- m0ze.ru/exploit/csrf-wp-login-security-and-history-v1.0.htmlX Refsource MISCExploitThird Party Advisory
- m0ze.ru/vulnerability/…X Refsource MISC