CVE-2021-24482: NEVER5 Related Posts

Medium severity, CVSS 4.8. EPSS: 0.7% chance of exploitation in the next 30 days.

The Related Posts for WordPress plugin through 2.0.4 does not sanitise its heading_text and CSS settings, allowing high privilege users (admin) to set XSS payloads in them, leading to Stored Cross-Site Scripting issues.

Affected products

• NEVER5 Related Posts: up to and including 2.0.4

Published 2021-07-19. Last modified 2026-06-17.