Medium severity4.3NVD Advisory· Published Sep 13, 2021· Updated Jun 17, 2026
CVE-2021-24586
CVE-2021-24586
Description
The Per page add to head WordPress plugin before 1.4.4 is lacking any CSRF check when saving its settings, which could allow attackers to make a logged in admin change them. Furthermore, as the plugin allows arbitrary HTML to be inserted in one of the setting (feature mentioned by the plugin), this could lead to Stored XSS issue which will be triggered either in the backend, frontend or both depending on the payload used.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
2- WordPress/Per page add to headdescription
- Range: <1.4.4
Patches
Vulnerability mechanics
References
1- wpscan.com/vulnerability/e9885fba-0e73-41a0-9e1d-47badc09be85nvdExploitThird Party Advisory
News mentions
0No linked articles in our index yet.