CVE-2021-24211: WordPress Related Posts <= 3.6.4 - Authenticated Stored Cross-Site Scripting (XSS)

Severity: medium (CVSS 5.4 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.6% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2021-04-05 · updated 2026-06-17
Weakness: CWE-79

Description

The WordPress Related Posts plugin through 3.6.4 contains an authenticated (admin+) stored XSS vulnerability in the title field on the settings page. By exploiting that an attacker will be able to execute JavaScript code in the user's browser.

Affected products

WordPress Related Posts: through 3.6.4

References

https://wpscan.com/vulnerability/37e0a033-3dee-476d-ae86-68354e8f0b1c
https://wpscan.com/vulnerability/37e0a033-3dee-476d-ae86-68354e8f0b1c

Get alerted when CVE-2021-24211 or the next vulnerability affects your stack