CVE-2021-20729: Netgate Pfsense Plus

Medium severity, CVSS 6.1. EPSS: 2.9% chance of exploitation in the next 30 days.

Cross-site scripting vulnerability in pfSense CE and pfSense Plus (pfSense CE software versions 2.5.2 and earlier, and pfSense Plus software versions 21.05 and earlier) allows a remote attacker to inject an arbitrary script via a malicious URL.

Affected products

• Netgate Pfsense Plus: up to and including 21.05
• Pfsense Pfsense: up to and including 2.5.2

Published 2022-03-31. Last modified 2026-06-17.