CVE-2021-24750: fallo en WP Visitor Statistics (Real Time Traffic)
WP Visitor Statistics (Real Time Traffic) < 4.8 - Subscriber+ SQL Injection
Publicada el · Actualizada el
Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.
72Vexday Risk Score
Corrige ahora. Ella explotación observada por VulnCheck y tiene exploit funcional público.
ssvc Actepss 38%
de la publicación al arma15 días
Publicada en NVD21 dic
1ª PoC+15d
VulnCheck+161d
The WP Visitor Statistics (Real Time Traffic) WordPress plugin before 4.8 does not properly sanitise and escape the refUrl in the refDetails AJAX action, available to any authenticated user, which could allow users with a role as low as subscriber to perform SQL injection attacks
Productos afectados
Unknown · WP Visitor Statistics (Real Time Traffic)PoCs públicas encontradas — 4
exploitdbwww.exploit-db.com/exploits/50619no verificadogithubgithub.com/fimtow/CVE-2021-24750★ 1cve_referencepacketstormsecurity.com/files/165433/WordPress-WP-Visitor-Statistics-4.7-SQL-Injection.htmlno verificadovulncheckvulncheck.com/xdb/687ae0b268c6no verificado⚠ Recursos públicos, para evaluar la exposición de sistemas que controlas o estás autorizado a probar. Prueba solo con autorización.
CVEs relacionadas — WP Visitor Statistics (Real Time Traffic)
En el mismo producto, de las más peligrosas a las menos.
CVE-2023-0600CRITICALWP Visitor Statistics (Real Time Traffic) < 6.9 - Unauthenticated SQLiEPSS 4.2%CVE-2022-0410—WP Visitor Statistics (Real Time Traffic) < 5.6 - Subscriber+ SQL InjectionEPSS 1.3%CVE-2021-25042—WP Visitor Statistics (Real Time Traffic) < 5.5 - Arbitrary IP Address Exclusion to Stored XSSEPSS 0.5%CVE-2022-4656MEDIUMWP Visitor Statistics (Real Time Traffic) < 6.5 - Contributor+ Stored XSS via ShortcodeEPSS 0.5%CVE-2026-117571HIGHWP Visitor Statistics (Real Time Traffic) < 8.8 - Unauthenticated Stored XSS via Tracker Device ParametersEPSS 0.3%CVE-2026-117572MEDIUMWP Visitor Statistics (Real Time Traffic) < 8.8 - Admin+ SQLi via 'order' ParameterEPSS 0.2%