CVE-2021-24180: Related Posts for WordPress < 2.0.4 - Authenticated Reflected Cross-Site Scripting (XSS)

Severity: medium (CVSS 5.4 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.6% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2021-04-05 · updated 2026-06-17
Weakness: CWE-79

Description

Unvalidated input and lack of output encoding within the Related Posts for WordPress plugin before 2.0.4 lead to a Reflected Cross-Site Scripting (XSS) vulnerability within the 'lang' GET parameter while editing a post, triggered when users with the capability of editing posts access a malicious URL.

Affected products

Related Posts for WordPress: before 2.0.4 — fixed in 2.0.4

How to fix

Upgrade to a fixed version: Related Posts for WordPress 2.0.4. Check the vendor advisory for mitigations.

References

https://wpscan.com/vulnerability/7593d5c8-cbc2-4469-b36b-5d4fb6d49718
https://wpscan.com/vulnerability/7593d5c8-cbc2-4469-b36b-5d4fb6d49718

Get alerted when CVE-2021-24180 or the next vulnerability affects your stack