Medium severity · published Jun 8, 2026
CVE-2021-47982
WordPress Plugin WP-Paginate 2.1.3 Stored XSS via preset
6.4
CVSS
0.2%
EPSS
No
On KEV
Description
WordPress Plugin WP-Paginate 2.1.3 contains a stored cross-site scripting vulnerability that allows authenticated attackers to inject malicious scripts by manipulating the preset parameter. Attackers can submit POST requests to the plugin settings page with script payloads in the preset parameter that are stored and executed when administrators view the settings.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
Low
Integrity
Low
Availability
None
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 8% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
WP
WP-Paginate · maxfoundry
2.1.3 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2021-47982
CVE.org
https://www.cve.org/CVERecord?id=CVE-2021-47982
wordpress.org
https://wordpress.org/plugins/wp-paginate/
www.exploit-db.com
https://www.exploit-db.com/exploits/49355
www.vulncheck.com
https://www.vulncheck.com/advisories/wordpress-plugin-wp-paginate-stored-xss-via-preset
More from WP-Paginate
4.8
CVE-2022-2050
The WP-Paginate WordPress plugin before 2.1.9 does not escape one of its settings, which could allow high privilege users to perform Stored Cross-Site Scripting attacks when…
4.8
CVE-2021-4222
The WP-Paginate WordPress plugin before 2.1.4 does not sanitise and escape its preset settings, allowing high privilege users such as admin to perform Cross-Site Scripting attacks…