CVE-2021-24481

The CVE-2021-24481 entry describes an authenticated stored XSS in the WordPress Any Hostname plugin (version up to 1.0.6) due to failure to sanitize/escape the Allowed hosts setting. Attackers with high privileges can inject XSS payloads via that setting, as documented by multiple sources (e.g., ...