Per Page Add to Head < 1.4.4 - CSRF to Stored XSS
Priority LOW 21CWE-352Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- Required
- Attack complexity
- Low
- Impact type
- Tampering, Cross-site scripting
- Confidentiality · integrity · availability
- None · Low · None
- Fix status
- Fixed
Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-352 and CWE-79.
Summary
The Per page add to head WordPress plugin before 1.4.4 is lacking any CSRF check when saving its settings, which could allow attackers to make a logged in admin change them. Furthermore, as the plugin allows arbitrary HTML to be inserted in one of the setting (feature mentioned by the plugin), this could lead to Stored XSS issue which will be triggered either in the backend, frontend or both depending on the payload used.
Why it matters now
EPSS 0.00483 41st percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Fixed Per page add to head (Unknown): 1.4.4
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Unknown | Per page add to head | 1.4.4 to before 1.4.4 | 1.4.4 | Patch available | CNA |
- Per page add to head VendorUnknown Affected 1.4.4 to before 1.4.4 Fixed in 1.4.4 Patch available CNA
Remediation
- Fix · CNA Per page add to head (Unknown) Fixed in 1.4.4
Timeline
- 2026-10-02 Threatist record created from CVE-2021-24586
- 2026-10-03 Alias added: GHSA-gm56-4fv5-gp9q
References
More Evona Per Page Add To Head vulnerabilities
- TI-2021-06902 Per Page Add to Head <= 1.4.4 - Authenticated Stored XSS CVSS 3.1MEDIUM 4.8
Sources
- CVE-2021-24586 · CVE Program
- CVE-2021-24586 · NVD
- FIRST EPSS
- GHSA-gm56-4fv5-gp9q · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences