Vulnerability · Published Aug 9, 2021 · Assigned by WPScan
CVE-2021-24509Page View Counts < 2.4.9 - Contributor+ Stored XSS
Medium 5.4
In plain English
A medium-severity cross-site scripting in Page View Count from Unknown. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.6% (higher than 50% of all known vulnerabilities).
Official description
The Page View Count WordPress plugin before 2.4.9 does not escape the postid parameter of pvc_stats shortcode, allowing users with a role as low as Contributor to perform Stored XSS attacks. A post made by a contributor would still have to be approved by an admin to have the XSS triggered in the frontend, however, higher privilege users, such as editor could exploit this without the need of approval, and even when the blog disallows the unfiltered_html capability.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Unknown | Page View Count | 2.4.9 – before 2.4.9 |
Weakness: CWE-79