| Package | Affected versions | Patched versions |
|---|---|---|
| hotjar connecticator | ≤ 1.1.1 |
The Hotjar Connecticator WordPress plugin through 1.1.1 is vulnerable to Stored Cross-Site Scripting (XSS) in the 'hotjar script' textarea. The request did include a CSRF nonce that was properly verified by the server and this vulnerability could only be exploited by administrator users.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free