CVE-2021-24481

The Any Hostname WordPress plugin through 1.0.6 does not sanitise or escape its "Allowed hosts" setting, leading to an authenticated stored XSS issue as high privilege users are able to set XSS payloads in it...

CVE-2021-24481 Any Hostname <= 1.0.6 - Authenticated Stored Cross-Site Scripting (XSS)

The Any Hostname WordPress plugin through 1.0.6 does not sanitise or escape its "Allowed hosts" setting, leading to an authenticated stored XSS issue as high privilege users are able to set XSS payloads in it...

CVE-2021-24481

The CVE-2021-24481 entry describes an authenticated stored XSS in the WordPress Any Hostname plugin (version up to 1.0.6) due to failure to sanitize/escape the Allowed hosts setting. Attackers with high privileges can inject XSS payloads via that setting, as documented by multiple sources (e.g., ...