What this actually is.
Technical background, root cause, and affected surface.
A Cross-Site Scripting (XSS) attack can cause arbitrary code (JavaScript) to run in a user’s browser while the browser is connected to a trusted website. The attack targets your application’s users and not the application itself while using your application as the attack’s vehicle. The XSS payload executes whenever the user opens the login page of the WordPress application..
- Vendor
- WordPress
- Affected Product
- Customize Login Image
- CVE
- CVE-2021-33851
- Securin ID
- 2021-CSW-11-1052
- Status
- Fixed
- Date
- December 2, 2021
- Severity
- Medium
- CVSS Score
- 5.4
- Vector
- CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
- CWE
- CWE-79
From one request
to root shell.
Reproduced in a sandboxed environment. Requires only LAN or WiFi adjacency.
What an attacker does to you.
Post-exploitation outcomes mapped to CVSS impact metrics.
An attacker can perform the following:
Inject malicious code into the vulnerable variable and exploit the application through the Cross-Site Scripting vulnerability.
Modify the code and get the session information of other users.
Compromise the user machine.
Fix it. In this order.
A runbook, not a checklist. Sequence matters — assume compromise before you act.
Perform context-sensitive encoding of entrusted input before echoing back to a browser using an encoding library throughout the application.
Implement input validation for special characters on all the variables are reflected in the browser and stored in the database.
Explicitly set the character set encoding for each page generated by the webserver.
Encode dynamic output elements and filter specific characters in dynamic elements.
Figure 04: The default Cross-Site Scripting mitigation setting in wp.config file to prevent XSS attacks
disclose@securin.ioVendors moved in days.
Attackers in hours.
Reconstructed from vendor advisories, CISA bulletins, and Securin research records.
Discovered in `Customize Login Image version 3.4 ` Product
Reported to WordPress team
Vendor fixed the issue
Vendor reopened the plugin for download
CVE assigned
Timeline recorded · Disclosure coordinated by Securin
Cite, verify, go deeper.
Primary sources — NVD, CISA KEV, and machine-readable IoC feed.