CVE-2021-41951: ResourceSpace reflected XSS in WordPress SSO plugin

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 18 September 2026. Confidence: high.

high priorityPublic exploit references and a very high EPSS score make exploitation likely, though the flaw requires user interaction and yields limited direct impact.

What it is

ResourceSpace before 9.6 rev 18290 contains a reflected cross-site scripting flaw in plugins/wordpress_sso/pages/index.php, reachable through the wordpress_user parameter. An attacker who convinces a victim to open a crafted URL can run JavaScript in the victim's browser session. Because the SSO page is involved, the script executes in the context of an authenticated ResourceSpace user.

Impact

An attacker gains script execution in the victim's browser, allowing theft of session data, actions performed as the victim, or redirection to malicious content. The CVSS scope change (S:C) means the impact can extend beyond the vulnerable component.

Attack surface

Reached over the network via a crafted URL to the wordpress_sso index page; no authentication is required to deliver the payload, but the victim must be persuaded to click the link (UI:R).

Exploitation

Not listed in CISA KEV, but EPSS is very high at 0.779 (99.5th percentile) and both references are tagged Exploit, indicating public exploit material exists.

What to do

• Upgrade ResourceSpace to 9.6 rev 18290 or later, which contains the fix.
• If immediate upgrade is not possible, restrict or disable the plugins/wordpress_sso endpoint until patched.
• Apply output encoding to the wordpress_user parameter and any other reflected input on the SSO page.
• Deploy a WAF rule blocking script payloads in the wordpress_user parameter as a temporary control.
• Review web logs for crafted wordpress_user values targeting the SSO page.

Detection

• Search HTTP access logs for requests to plugins/wordpress_sso/pages/index.php with script tags, event handlers, or encoded payloads in the wordpress_user parameter.
• Alert on URL-encoded angle brackets, javascript: schemes, or onerror/onload strings in query strings hitting the SSO endpoint.
• Monitor for outbound browser requests or referrer anomalies originating from the ResourceSpace SSO page.
• Correlate repeated SSO page hits from a single source with unusual user-agent or referrer patterns.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.