CVE-2021-24364: Jannah < 5.4.4 - Reflected Cross-Site Scripting (XSS)

Severity: medium (CVSS 6.1 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 2.0% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2021-06-21 · updated 2026-06-17
Weakness: CWE-79

Description

The Jannah WordPress theme before 5.4.4 did not properly sanitize the options JSON parameter in its tie_get_user_weather AJAX action before outputting it back in the page, leading to a Reflected Cross-Site Scripting (XSS) vulnerability.

Affected products

TieLabs Jannah: before 5.4.4 — fixed in 5.4.4

How to fix

Upgrade to a fixed version: TieLabs Jannah 5.4.4. Check the vendor advisory for mitigations.

References

https://wpscan.com/vulnerability/1d53fbe5-a879-42ca-a9d3-768a80018382
https://wpscan.com/vulnerability/1d53fbe5-a879-42ca-a9d3-768a80018382

Get alerted when CVE-2021-24364 or the next vulnerability affects your stack