What’s Vulnerable › Vulnerabilities

CVE-2021-24545: WP HTML Author Bio <= 1.2.0 - Author+ Stored Cross-Site Scripting

• Severity: medium (CVSS 5.4 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 1.8% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2021-10-11 · updated 2026-06-17
• Weakness: CWE-79

Description

The WP HTML Author Bio WordPress plugin through 1.2.0 does not sanitise the HTML allowed in the Bio of users, allowing them to use malicious JavaScript code, which will be executed when anyone visit a post in the frontend made by such user. As a result, user with a role as low as author could perform Cross-Site Scripting attacks against users, which could potentially lead to privilege escalation when an admin view the related post/s.

Affected products

• WP HTML Author Bio: through 1.2.0

References

• https://wpscan.com/vulnerability/64267134-9d8c-4e0c-b24f-d18692a5775e
• https://wpscan.com/vulnerability/64267134-9d8c-4e0c-b24f-d18692a5775e

Get alerted when CVE-2021-24545 or the next vulnerability affects your stack