PT-2021-15838
CVE-2021-24301
·
Published
2021-05-24
·
Updated
2021-05-28
Description by
CVSS 3.1
5.4
MediumMetricsAV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Name of the Vulnerable Software and Affected Versions
Hotjar Connecticator WordPress plugin versions through 1.1.1
Description
The issue concerns Stored Cross-Site Scripting (XSS) in the
hotjar script textarea. This could be exploited by administrator users, as the request includes a CSRF nonce that is properly verified by the server.Recommendations
For Hotjar Connecticator WordPress plugin versions through 1.1.1, consider disabling the
hotjar script textarea until a patch is available to prevent potential exploitation.Exploitability
Exploit
Fix
Impacts
Researchers
Vendors
Affected products
Found an issue in the description? Have something to add? Feel free to write us 👾