Medium severity · published Mar 14, 2022
CVE-2021-25026
Patreon WordPress < 1.8.2 - Admin+ Stored Cross-Site Scripting
5.5
CVSS
0.7%
EPSS
No
On KEV
Description
The Patreon WordPress plugin before 1.8.2 does not sanitise and escape the field "Custom Patreon Page name", which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
High
User interaction
None
Confidentiality
Low
Integrity
Low
Availability
None
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)0.7% · higher than 53% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
PW
Patreon WordPress ·
1.8.2 before 1.8.2 · source: vendor, NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2021-25026
CVE.org
https://www.cve.org/CVERecord?id=CVE-2021-25026
Patch
https://plugins.trac.wordpress.org/changeset/2682069
Exploit
https://wpscan.com/vulnerability/02756dd3-832a-4846-b9e1-a34f148b5cfe
More from Patreon WordPress
6.5
CVE-2026-92433
Patreon WordPress < 1.10.0 - Patreon Integration Takeover via CSRF
4.3
CVE-2026-92432
Patreon WordPress < 1.10.0 - Open Redirect via 'state' Parameter
3.7
CVE-2026-92431
Patreon WordPress < 1.10.0 - Unauthenticated Taxonomy and Term Enumeration