CVE-2021-24214: Daggerhartlab Openid Connect Generic Client

Medium severity, CVSS 6.1. EPSS: 1.6% chance of exploitation in the next 30 days.

The OpenID Connect Generic Client WordPress plugin 3.8.0 and 3.8.1 did not sanitise the login error when output back in the login form, leading to a reflected Cross-Site Scripting issue. This issue does not require authentication and can be exploited with the default configuration.

Affected products

• Daggerhartlab Openid Connect Generic Client: version 3.8.0 only; version 3.8.1 only

Published 2021-05-06. Last modified 2026-06-17.