CVE-2021-24301

MEDIUM 5.4CVE-2021-24301 · Published 24/05/2021 · updated 17/06/2026

In short

CVE-2021-24301 is a MEDIUM (CVSS 5.4) vulnerability affecting hotjar connecticator (bluemedicinelabs).
Chance of exploitation in the next 30 days (EPSS): 0.62%, higher than 50.2% of all vulnerabilities.
No patched version is listed yet: follow the vendor's advisory in References.

Package	Affected versions	Patched versions
hotjar connecticator bluemedicinelabs	`≤ 1.1.1`	No fix yet

Description

The Hotjar Connecticator WordPress plugin through 1.1.1 is vulnerable to Stored Cross-Site Scripting (XSS) in the 'hotjar script' textarea. The request did include a CSRF nonce that was properly verified by the server and this vulnerability could only be exploited by administrator users.

References

wpscan.com/vulnerability/eb8e2b9d-f153-49c9-862a-5c016934f9ad · Exploit

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free