CVE-2021-24798

The WP Header Images plugin versions prior to 2.0.1 contains a reflected cross-site scripting vulnerability due to insufficient input handling of the t parameter on the plugin's settings page. An attacker could exploit this flaw by crafting a malicious link containing injected code that executes in a user's browser when the settings page is accessed. The vulnerability stems from the plugin's failure to properly sanitize and escape user-supplied input before displaying it back to users.

Based on public CVE data (MITRE/NVD).