CVE-2021-24481: Any Hostname <= 1.0.6 - Authenticated Stored Cross-Site Scripting (XSS)

Severity: medium (CVSS 4.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.6% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2021-08-02 · updated 2026-06-17
Weakness: CWE-79

Description

The Any Hostname WordPress plugin through 1.0.6 does not sanitise or escape its "Allowed hosts" setting, leading to an authenticated stored XSS issue as high privilege users are able to set XSS payloads in it

Affected products

Any Hostname: through 1.0.6

References

https://wpscan.com/vulnerability/a4c352de-9815-4dfe-ac51-65b5bfb37438
https://wpscan.com/vulnerability/a4c352de-9815-4dfe-ac51-65b5bfb37438

Get alerted when CVE-2021-24481 or the next vulnerability affects your stack