CVE-2021-39310: Windyroad Real Wysiwyg

Medium severity, CVSS 6.1. EPSS: 0.8% chance of exploitation in the next 30 days.

The Real WYSIWYG WordPress plugin is vulnerable to Reflected Cross-Site Scripting due to the use of PHP_SELF in the ~/real-wysiwyg.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 0.0.2.

Affected products

• Windyroad Real Wysiwyg: up to and including 0.0.2

Published 2021-12-14. Last modified 2026-06-17.