CVE-2021-24920

MEDIO 4.8CVE-2021-24920 · Published 28/02/2022 · updated 17/06/2026

In breve

CVE-2021-24920 è una vulnerabilità MEDIO (CVSS 4.8) che riguarda statcounter (statcounter).
Probabilità di sfruttamento nei prossimi 30 giorni (EPSS): 0.65%, superiore al 51.3% delle vulnerabilità.
Correzione: aggiornare a 2.0.7 o successiva.

Package	Affected versions	Patched versions
statcounter statcounter	`< 2.0.7`	`2.0.7`

Description

The StatCounter WordPress plugin before 2.0.7 does not sanitise and escape the Project ID and Secure Code settings, which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed

References

plugins.trac.wordpress.org/changeset/2664933 · Release Notes
wpscan.com/vulnerability/b00b5037-8ce4-4f61-b2ce-33315b39454e · Exploit

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free