CVE-2021-25042: falha em WP Visitor Statistics (Real Time Traffic)
WP Visitor Statistics (Real Time Traffic) < 5.5 - Arbitrary IP Address Exclusion to Stored XSS
Publicada em · Atualizada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
3Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackepss 0.5%
The WP Visitor Statistics (Real Time Traffic) WordPress plugin before 5.5 does not have authorisation and CSRF checks in the updateIpAddress AJAX action, allowing any authenticated user to call it, or make a logged in user do it via a CSRF attack and add an arbitrary IP address to exclude. Furthermore, due to the lack of validation, sanitisation and escaping, users could set a malicious value and perform Cross-Site Scripting attacks against logged in admin
Produtos afetados
Unknown · WP Visitor Statistics (Real Time Traffic)CVEs relacionadas — WP Visitor Statistics (Real Time Traffic)
No mesmo produto, das mais perigosas para as menos.
CVE-2021-24750—WP Visitor Statistics (Real Time Traffic) < 4.8 - Subscriber+ SQL InjectionEPSS 38.3%CVE-2023-0600CRITICALWP Visitor Statistics (Real Time Traffic) < 6.9 - Unauthenticated SQLiEPSS 4.2%CVE-2022-0410—WP Visitor Statistics (Real Time Traffic) < 5.6 - Subscriber+ SQL InjectionEPSS 1.3%CVE-2022-4656MEDIUMWP Visitor Statistics (Real Time Traffic) < 6.5 - Contributor+ Stored XSS via ShortcodeEPSS 0.5%CVE-2026-117571HIGHWP Visitor Statistics (Real Time Traffic) < 8.8 - Unauthenticated Stored XSS via Tracker Device ParametersEPSS 0.3%CVE-2026-117572MEDIUMWP Visitor Statistics (Real Time Traffic) < 8.8 - Admin+ SQLi via 'order' ParameterEPSS 0.2%