Skip to content
CVE PROGRAM SOURCE RECORDUnscored

CVE-2021-24957

Advanced Page Visit Counter < 6.1.6 - Subscriber+ Blind SQL injection

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
WPScan

Description

The Advanced Page Visit Counter WordPress plugin before 6.1.6 does not escape the artID parameter before using it in a SQL statement in the apvc_reset_count_art AJAX action, available to any authenticated user, leading to a SQL injection

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Unknown Advanced Page Visit Counter – Advanced WordPress Visit Counter

  • 6.1.6 to < 6.1.6affected

References