Vulnerability · Published Dec 14, 2021 · Assigned by Wordfence

CVE-2021-41836Fathom Analytics <= 3.0.4 Authenticated Stored Cross-Site Scripting

Medium 4.8

In plain English

A medium-severity cross-site scripting in Fathom Analytics from Fathom Analytics. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.6% (higher than 48% of all known vulnerabilities).

Severity (CVSS 3.1)4.8Medium

Exploit odds (30 days)0.6%top 51.9% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

The Fathom Analytics WordPress plugin is vulnerable to Stored Cross-Site Scripting due to insufficient input validation and escaping via the $site_id parameter found in the ~/fathom-analytics.php file which allowed attackers with administrative user access to inject arbitrary web scripts, in versions up to and including 3.0.4. This affects multi-site installations where unfiltered_html is disabled for administrators, and sites where unfiltered_html is disabled.

Affected products (as reported)

Vendor	Product	Versions
Fathom Analytics	Fathom Analytics	3.0.4 – through 3.0.4

Weakness: CWE-79 · Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

In plain English

Official description

Affected products (as reported)

References