CVE-2021-24750observed exploitationCWE-89

CVE-2021-24750: vulnerability in WP Visitor Statistics (Real Time Traffic)

WP Visitor Statistics (Real Time Traffic) < 4.8 - Subscriber+ SQL Injection

Published · Updated

Follow this CVE+ Monitor WP Visitor Statistics

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

72Vexday Risk Score

Patch now. It exploitation observed by VulnCheck and has a working public exploit.

ssvc Actepss 38%
from disclosure to weapon15 days
Published on NVDDec 21
1st PoC+15d
VulnCheck+161d
The WP Visitor Statistics (Real Time Traffic) WordPress plugin before 4.8 does not properly sanitise and escape the refUrl in the refDetails AJAX action, available to any authenticated user, which could allow users with a role as low as subscriber to perform SQL injection attacks
Affected products
Unknown · WP Visitor Statistics (Real Time Traffic)
⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.
Related CVEs — WP Visitor Statistics (Real Time Traffic)

In the same product, most dangerous first.

CVE-2023-0600CRITICALWP Visitor Statistics (Real Time Traffic) < 6.9 - Unauthenticated SQLiEPSS 4.2%CVE-2022-0410—WP Visitor Statistics (Real Time Traffic) < 5.6 - Subscriber+ SQL InjectionEPSS 1.3%CVE-2021-25042—WP Visitor Statistics (Real Time Traffic) < 5.5 - Arbitrary IP Address Exclusion to Stored XSSEPSS 0.5%CVE-2022-4656MEDIUMWP Visitor Statistics (Real Time Traffic) < 6.5 - Contributor+ Stored XSS via ShortcodeEPSS 0.5%CVE-2026-117571HIGHWP Visitor Statistics (Real Time Traffic) < 8.8 - Unauthenticated Stored XSS via Tracker Device ParametersEPSS 0.3%CVE-2026-117572MEDIUMWP Visitor Statistics (Real Time Traffic) < 8.8 - Admin+ SQLi via 'order' ParameterEPSS 0.2%