Skip to content
CVE PROGRAM SOURCE RECORDUnscored

CVE-2021-24829

Visitor Traffic Real Time Statistics < 3.9 - Subscriber+ SQL Injection

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
WPScan

Description

The Visitor Traffic Real Time Statistics WordPress plugin before 3.9 does not validate and escape user input passed to the today_traffic_index AJAX action (available to any authenticated users) before using it in a SQL statement, leading to an SQL injection issue

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Unknown Visitor Traffic Real Time Statistics

  • 3.9 to < 3.9affected

References