CVE-2021-24750CWE-89

WP Visitor Statistics (Real Time Traffic) < 4.8 - Subscriber+ SQL Injection

published December 21, 2021

CVSS
—
EPSS
38%
Percentile
98.6
In the wild
Unconfirmed
What it is

The WP Visitor Statistics (Real Time Traffic) WordPress plugin before 4.8 does not properly sanitise and escape the refUrl in the refDetails AJAX action, available to any authenticated user, which could allow users with a role as low as subscriber to perform SQL injection attacks

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.38298 · 98.6th percentile
Weakness
CWE-89 · Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Published
2021-12-21T08:45Z
EPSS history
Timeline
  • 21 DEC 08:45Z
    WP Visitor Statistics (Real Time Traffic) < 4.8 - Subscriber+ SQL Injection
    cvelistv5