Is CVE-2021-24654 actively exploited?

Yes. CVE-2021-24654 is listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, which means exploitation in the wild has been confirmed.

Can CVE-2021-24654 be exploited remotely?

The attack vector of CVE-2021-24654 has not been classified yet.

What is the CVSS score of CVE-2021-24654?

CVE-2021-24654 has not received a CVSS score yet.

HOME VULNERABILITIESCVE-2021-24654

UNKNOWNCISA KEVIN THE WILD

CVE-2021-24654

Published: April 11, 2026

EPSS:0.50%probability of exploitation in 30 daysPercentile:66.1th

Official Description

The User Registration WordPress plugin before 2.0.2 does not properly sanitise the user_registration_profile_pic_url value when submitted directly via the user_registration_update_profile_details AJAX action. This could allow any authenticated user, such as subscriber, to perform Stored Cross-Site attacks when their profile is viewed

NVD Source

Risk Analysis

This vulnerability in the User Registration WordPress plugin allows any authenticated user, such as a subscriber, to perform Stored Cross-Site Scripting (XSS) attacks. This is due to improper sanitization of the user_registration_profile_pic_url value during an AJAX action. The active exploitation and presence in CISA's KEV catalog highlight the risk.

This vulnerability is actively exploited in the wild and is listed in CISA's Known Exploited Vulnerabilities catalog. The Stored XSS can be performed by any authenticated user, making it remotely exploitable once an attacker has low-level access.

Recommended Action

Update the User Registration WordPress plugin to version 2.0.2 or higher. Implement thorough sanitization and escaping of all user-supplied input, especially for profile fields, to prevent Stored XSS vulnerabilities.

Generated by the CTIWATCH analysis pipeline from this CVE's metadata (CVSS, EPSS, KEV status, exploit intelligence). Verify against vendor advisories before acting.

Technical Analysis

CVE-2021-24654 requires local access, meaning attackers must already have a foothold on the target system.

Exploitation requires some privileges, which limits the exposure to scenarios where an attacker has already gained initial access.

CISA has added CVE-2021-24654 to the Known Exploited Vulnerabilities (KEV) catalog, confirming active exploitation in the wild. U.S. federal agencies are required to patch this within the mandated timeframe, and all organizations should treat remediation as urgent.