CVE-2022-0410CWE-89

WP Visitor Statistics (Real Time Traffic) < 5.6 - Subscriber+ SQL Injection

published March 7, 2022

CVSS
—
EPSS
1%
Percentile
70.6
In the wild
Unconfirmed
What it is

The WP Visitor Statistics (Real Time Traffic) WordPress plugin before 5.6 does not sanitise and escape the id parameter before using it in a SQL statement via the refUrlDetails AJAX action, available to any authenticated user, leading to a SQL injection

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.01318 · 70.6th percentile
Weakness
CWE-89 · Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Published
2022-03-07T08:16Z
EPSS history
Timeline
  • 07 MAR 08:16Z
    WP Visitor Statistics (Real Time Traffic) < 5.6 - Subscriber+ SQL Injection
    cvelistv5