Cross-Site Request Forgery in GetSimple CMS Custom JS Plugin
CVE-2021-47860

8.5HIGH

Key Information:

Vendor: Getsimple Cms
Status: Custom Js Plugin
Vendor: CVE Published:; 21 January 2026

🔔 Create Getsimple Cms Vulnerability Alert

Badges

👾 Exploit Exists🟡 Public PoC

What is CVE-2021-47860?

The GetSimple CMS Custom JS 0.1 plugin is vulnerable to Cross-Site Request Forgery, enabling attackers to exploit the system by injecting arbitrary client-side code into the browsers of authenticated administrators. When an administrator visits a specially crafted malicious webpage, this vulnerability can lead to execution of a malicious payload, potentially affecting the hosting server with remote code execution capabilities. This poses a significant risk, as unauthorized access could result in critical data exposure and system compromise.

Affected Version(s)

Custom JS Plugin 0.1

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

CVE-2021-47860 - Proof of Concept