Stored Cross-Site Scripting Vulnerability in WordPress Visitors Plugin

CVE-2022-4541

What is CVE-2022-4541?

The WordPress Visitors plugin is susceptible to Stored Cross-Site Scripting (XSS) vulnerabilities because of its inadequate input sanitization and output escaping mechanisms, specifically when processing spoofed HTTP Header values. This flaw enables unauthenticated attackers to inject malicious JavaScript code into the nm_visitor pages, resulting in the potential execution of arbitrary scripts whenever these pages are accessed by users, posing significant risks to user data and application integrity.

References