CVE-2021-47860: Get-Simple Getsimplecms

Medium severity, CVSS 4.3. EPSS: 0.3% chance of exploitation in the next 30 days.

GetSimple CMS Custom JS 0.1 plugin contains a cross-site request forgery vulnerability that allows unauthenticated attackers to inject arbitrary client-side code into administrator browsers. Attackers can craft a malicious website that triggers a cross-site scripting payload to execute remote code on the hosting server when an authenticated administrator visits the page.

Affected products

• Get-Simple Getsimplecms: version 0.1 only

Published 2026-01-21. Last modified 2026-06-17.