CVEvulnerability

CVE-2021-25042

5.4 MEDIUM Published 2022-02-28 Modified 2026-06-17 Official page ↗
Status
Analyzed
Published
2022-02-28
Last modified
2026-06-17
Assigner
[email protected]
CVSS 3.1 ([email protected])
5.4 MEDIUM — CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
CVSS 2.0 ([email protected])
3.5 LOW — AV:N/AC:M/Au:S/C:N/I:P/A:N
Weaknesses
CWE-862

Description

The WP Visitor Statistics (Real Time Traffic) WordPress plugin before 5.5 does not have authorisation and CSRF checks in the updateIpAddress AJAX action, allowing any authenticated user to call it, or make a logged in user do it via a CSRF attack and add an arbitrary IP address to exclude. Furthermore, due to the lack of validation, sanitisation and escaping, users could set a malicious value and perform Cross-Site Scripting attacks against logged in admin

Affected configurations

• codepress visitor statistics (< 5.5)

Related

Weakness · CWE (1)

  • CWE-862 Missing Authorization weakness

References