CVE-2021-24509

The Page View Count WordPress plugin before 2.4.9 does not escape the postid parameter of pvcstats shortcode, allowing users with a role as low as Contributor to perform Stored XSS attacks. A post made by a contributor would still have to be approved by an admin to have the XSS triggered in the...

CVE-2021-24509

The CVE-2021-24509 vulnerability affects the WordPress Page View Count plugin before 2.4.9. The pvc_stats shortcode’s postid parameter is not escaped, allowing Stored XSS when mishandled inputs reach the frontend. Impact notes indicate that contributors can trigger XSS (with admin approval possib...