CVE-2021-47860: GetSimple CMS Custom JS 0.1 - CSRF to XSS to RCE

Published Jan 21, 2026

Updated

GetSimple CMS Custom JS 0.1 plugin contains a cross-site request forgery vulnerability that allows unauthenticated attackers to inject arbitrary client-side code into administrator browsers. Attackers can craft a malicious website that triggers a cross-site scripting payload to execute remote code on the hosting server when an authenticated administrator visits the page.

Affected Software

2 affected components

GetSimple CMS GetSimple CMS Custom JS

Get-simple Getsimplecms=0.1

Event History

Jan 21, 2026

CVE Published

via MITRE·05:29 PM

Data Sourced

via MITRE·05:29 PM

DescriptionSeverityWeakness

Data Sourced

via NVD·06:16 PM

DescriptionSeverityWeaknessAffected Software

Frequently Asked Questions

What is the severity of CVE-2021-47860?

CVE-2021-47860 has a high severity rating due to its ability to allow remote code execution through cross-site request forgery and cross-site scripting.

How do I fix CVE-2021-47860?

To fix CVE-2021-47860, you should update the GetSimple CMS Custom JS plugin to the latest version that addresses this vulnerability.

Can CVE-2021-47860 be exploited by an unauthenticated attacker?

Yes, CVE-2021-47860 allows unauthenticated attackers to exploit the vulnerability by injecting arbitrary client-side code.

What type of attack is associated with CVE-2021-47860?

CVE-2021-47860 involves a cross-site request forgery (CSRF) that can lead to cross-site scripting (XSS) and remote code execution (RCE).

What software is affected by CVE-2021-47860?

CVE-2021-47860 affects the GetSimple CMS Custom JS plugin version 0.1.