Vulnerability · Published Jun 14, 2021 · Assigned by WPScan

CVE-2021-24350Visitors <= 0.3 - Unauthenticated Stored Cross-Site Scripting (XSS)

Medium 6.1

In plain English

A medium-severity cross-site scripting in Visitors from Unknown. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.3% (higher than 71% of all known vulnerabilities).

Severity (CVSS NVD)6.1Medium

Exploit odds (30 days)1.3%top 29.4% of all CVEs

Exploited in the wildNo reportsnot in CISA KEV

Attack toolingNoneno public tooling known

Official description

The Visitors WordPress plugin through 0.3 is affected by an Unauthenticated Stored Cross-Site Scripting (XSS) vulnerability. The plugin would display the user's user agent string without validation or encoding within the WordPress admin panel.

Affected products (as reported)

Vendor	Product	Versions
Unknown	Visitors	0.3 – through 0.3

Weakness: CWE-79

References

https://wpscan.com/vulnerability/06f1889d-8e2f-481a-b91b-3a8008e00ffc x_refsource_CONFIRM