CVE-2021-24756: WP System Log < 1.0.21 - Unauthenticated Stored Cross-Site Scripting

Severity: medium (CVSS 6.1 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.3% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2021-12-13 · updated 2026-06-17
Weakness: CWE-79

Description

The WP System Log WordPress plugin before 1.0.21 does not sanitise, validate and escape the IP address retrieved from login requests before outputting them in the admin dashboard, which could allow unauthenticated attacker to perform Cross-Site Scripting attacks against admins viewing the logs.

Affected products

WP System Log: before 1.0.21 — fixed in 1.0.21

How to fix

Upgrade to a fixed version: WP System Log 1.0.21. Check the vendor advisory for mitigations.

References

https://wpscan.com/vulnerability/0cea0717-8f54-4f1c-b3ee-aff7dd91bf59
https://wpscan.com/vulnerability/0cea0717-8f54-4f1c-b3ee-aff7dd91bf59

Get alerted when CVE-2021-24756 or the next vulnerability affects your stack