CVE-2021-24509

The CVE-2021-24509 vulnerability affects the WordPress Page View Count plugin before 2.4.9. The pvc_stats shortcode’s postid parameter is not escaped, allowing Stored XSS when mishandled inputs reach the frontend. Impact notes indicate that contributors can trigger XSS (with admin approval possib...

CVE-2021-24509: Improper Neutralization of Input During Web Page Generation

The Page View Count WordPress plugin before 2.4.9 does not escape the postid parameter of pvcstats shortcode, allowing users with a role as low as Contributor to perform Stored XSS attacks. A post made by a contributor would still have to be approved by an admin to have the XSS triggered in the...

WordPress 跨站脚本漏洞

WordPress is the WordPress Wordpress Foundation's set of blogging platforms developed using the PHP language. A cross-site scripting vulnerability exists in the Page View Count plugin for WordPress prior to 2.4.9, which fails to escape the postid parameter of the pvcstats shortcode, allowing user...