CVE-2023-1259 Hotjar <= 1.0.15 - Authenticated (Administrator+) Stored Cross-Site Scripting

The Hotjar plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the hotjarsiteid in versions up to, and including, 1.0.15 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above...

PT-2023-16843 · WordPress · Hotjar Plugin

Name of the Vulnerable Software and Affected Versions: Hotjar plugin for WordPress versions up to, and including, 1.0.15 Description: The issue arises from insufficient input sanitization and output escaping, allowing authenticated attackers with administrator-level permissions to inject arbitrar...

WordPress Hotjar Plugin <= 1.0.15 is vulnerable to Cross Site Scripting (XSS)

Software Hotjar Type Plugin Vulnerable versions = 1.0.15 Fixed in 1.0.16 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2023-1259 Patch priority Low CVSS severity Low 5.9 Developer Claim ownership PSID e7f6eb874af7 Credits Marco Wotschka Required privile...

WordPress plugin Hotjar 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A cross-site scripting vulnerability exists...

Malicious code in frontend-hotjar (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware ec51712a6106a9fc3f403e01005e68628085ce8e2bc91784c0f0e3b0dc2ae4b9 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-3222 Malicious code in frontend-hotjar (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware ec51712a6106a9fc3f403e01005e68628085ce8e2bc91784c0f0e3b0dc2ae4b9 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in @frontend-metrics/hotjar (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware fc044ca69fb03444fe01161e81c79dd2bdd764aa2944339cee044016185990e5 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-280 Malicious code in @frontend-metrics/hotjar (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware fc044ca69fb03444fe01161e81c79dd2bdd764aa2944339cee044016185990e5 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

WordPress Hotjar Connecticator plugin <= 1.1.1 - Toggle The Debug Mode via Cross-Site Request Forgery (CSRF) vulnerability

Sensitive Information Disclosure vulnerability discovered in WordPress Hotjar Connecticator plugin versions = 1.1.1. Solution No patched version available...

WordPress Hotjar Connecticator plugin <= 1.1.1 - Sensitive Information Disclosure vulnerability

Sensitive Information Disclosure vulnerability discovered in WordPress Hotjar Connecticator plugin versions = 1.1.1. Solution No patched version available...

CVE-2021-24301

The Hotjar Connecticator WordPress plugin through 1.1.1 is vulnerable to Stored Cross-Site Scripting XSS in the 'hotjar script' textarea. The request did include a CSRF nonce that was properly verified by the server and this vulnerability could only be exploited by administrator users...

CVE-2021-24301

The Hotjar Connecticator WordPress plugin through 1.1.1 is vulnerable to Stored Cross-Site Scripting XSS in the 'hotjar script' textarea. The request did include a CSRF nonce that was properly verified by the server and this vulnerability could only be exploited by administrator users...

CVE-2021-24301

The Hotjar Connecticator WordPress plugin through 1.1.1 is vulnerable to Stored Cross-Site Scripting XSS in the 'hotjar script' textarea. The request did include a CSRF nonce that was properly verified by the server and this vulnerability could only be exploited by administrator users...

Cross site scripting

The Hotjar Connecticator WordPress plugin through 1.1.1 is vulnerable to Stored Cross-Site Scripting XSS in the 'hotjar script' textarea. The request did include a CSRF nonce that was properly verified by the server and this vulnerability could only be exploited by administrator users...

CVE-2021-24301

The CVE-2021-24301 entry applies to the WordPress plugin Hotjar Connecticator (

CVE-2021-24301 Hotjar Connecticator <= 1.1.1 - Authenticated Stored Cross-Site Scripting (XSS)

The Hotjar Connecticator WordPress plugin through 1.1.1 is vulnerable to Stored Cross-Site Scripting XSS in the 'hotjar script' textarea. The request did include a CSRF nonce that was properly verified by the server and this vulnerability could only be exploited by administrator users...

Hotjar Connecticator <= 1.1.1 - Authenticated Stored Cross-Site Scripting (XSS)

The plugin was vulnerable to Stored Cross-Site Scripting XSS in the "hotjar script" textarea. The request did include a CSRF nonce that was properly verified by the server and this vulnerability could only be exploited by administrator users. PoC Step 1: Install and activate the plugin "Hotjar...

WordPress Hotjar Connecticator plugin <= 1.1.1 - Authenticated Stored Cross-Site Scripting (XSS) vulnerability

Authenticated Stored Cross-Site Scripting XSS vulnerability discovered by Kishore Hariram in WordPress Hotjar Connecticator plugin versions = 1.1.1. Solution This plugin has been closed as of May 5, 2021 and is not available for download. This closure is temporary, pending a full review...

Hotjar Connecticator <= 1.1.1 - Authenticated Stored Cross-Site Scripting (XSS)

The plugin was vulnerable to Stored Cross-Site Scripting XSS in the "hotjar script" textarea. The request did include a CSRF nonce that was properly verified by the server and this vulnerability could only be exploited by administrator users. Step 1: Install and activate the plugin "Hotjar...

help.hotjar.com Cross Site Scripting vulnerability

Security Researcher Hchabik Helped patch 2349 vulnerabilities Received 5 Coordinated Disclosure badges Received 2 recommendations , a holder of 5 badges for responsible and coordinated disclosure, found a security vulnerability affecting help.hotjar.com website and its users. Following coordinate...