CVE-2021-24364: vulnerability in TieLabs Jannah
Jannah < 5.4.4 - Reflected Cross-Site Scripting (XSS)
Published · Updated
18Vexday Risk Score
Patch soon. It has a working public exploit.
ssvc Attendepss 2.0%
exploitation probability
2.0%top 20% of all CVEs
observed exploitation
nono source reports it
The Jannah WordPress theme before 5.4.4 did not properly sanitize the options JSON parameter in its tie_get_user_weather AJAX action before outputting it back in the page, leading to a Reflected Cross-Site Scripting (XSS) vulnerability.
Affected products
TieLabs · JannahRelated CVEs — TieLabs Jannah
In the same product, most dangerous first.
CVE-2021-24407—Jannah < 5.4.5 - Reflected Cross-Site Scripting (XSS)EPSS 2.6%CVE-2026-25464HIGHWordPress Jannah theme <= 7.6.4 - Local File Inclusion vulnerabilityEPSS 0.6%CVE-2025-53334HIGHWordPress Jannah Theme < 7.5.1 - Local File Inclusion VulnerabilityEPSS 0.5%CVE-2025-64206CRITICALWordPress Jannah theme <= 7.6.0 - PHP Object Injection vulnerabilityEPSS 0.5%CVE-2025-64205HIGHWordPress Jannah theme <= 7.6.0 - Local File Inclusion vulnerabilityEPSS 0.4%CVE-2025-64207HIGHWordPress Jannah theme <= 7.6.0 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%