CVE-2021-24619: Per Page Add to Head <= 1.4.4 - Authenticated Stored XSS

Severity: medium (CVSS 4.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.6% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2021-09-13 · updated 2026-06-17
Weakness: CWE-79

Description

The Per page add to head WordPress plugin through 1.4.4 does not properly sanitise one of its setting, allowing malicious HTML to be inserted by high privilege users even when the unfiltered_html capability is disallowed, which could lead to Cross-Site Scripting issues.

Affected products

Per page add to head: through 1.4.4

References

https://wpscan.com/vulnerability/f360f383-0646-44ca-b49e-e2258dfbf3a6
https://wpscan.com/vulnerability/f360f383-0646-44ca-b49e-e2258dfbf3a6

Get alerted when CVE-2021-24619 or the next vulnerability affects your stack