Vulnerability record · CVE-2021-24750 · published 21 December 2021

CVE-2021-24750: Codepress visitor statistics sql injection vulnerability

Codepress · Visitor Statistics

The WP Visitor Statistics (Real Time Traffic) WordPress plugin before 4.8 does not properly sanitise and escape the refUrl in the refDetails AJAX action, available to any authenticated user, which could allow users with a role as low as subscriber to perform SQL injection attacks

8.8 CVSS 3.1 High EPSS 38% · top 1.5% CWE-89 · SQL injection

8.8CVSS 3.1 base score, v2 6.5

38%EPSS exploitation probability, 30 days

NoNot in CISA KEV

1Affected product versions listed by NVD

6References, 4 tagged exploit

17 Jun 2026Last modified by NVD

Description

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

Visitor Statistics Codepress

References

Link	Tags
http://packetstormsecurity.com/files/165433/WordPress-WP-Visitor-Statistics-4.7-SQL-Injection.html	ExploitThird Party AdvisoryVDB Entry
https://plugins.trac.wordpress.org/changeset/2622268	PatchThird Party Advisory
https://wpscan.com/vulnerability/7528aded-b8c9-4833-89d6-9cd7df3620de	ExploitThird Party Advisory
http://packetstormsecurity.com/files/165433/WordPress-WP-Visitor-Statistics-4.7-SQL-Injection.html	ExploitThird Party AdvisoryVDB Entry
https://plugins.trac.wordpress.org/changeset/2622268	PatchThird Party Advisory
https://wpscan.com/vulnerability/7528aded-b8c9-4833-89d6-9cd7df3620de	ExploitThird Party Advisory

Track CVE-2021-24750 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

9.8CVE-2023-0600Codepress visitor statistics sql injection vulnerabilityThe WP Visitor Statistics (Real Time Traffic) WordPress plugin before 6.9 does not escape user input which is concatenated to an SQL query, allowing …EPSS 4.2%15 May 2023 9.8CVE-2022-33965Codepress visitor statistics sql injection vulnerabilityMultiple Unauthenticated SQL Injection (SQLi) vulnerabilities in Osamaesh WP Visitor Statistics plugin <= 5.7 at WordPress.EPSS 4.4%25 Jul 2022 8.8CVE-2022-0410Codepress visitor statistics sql injection vulnerabilityThe WP Visitor Statistics (Real Time Traffic) WordPress plugin before 5.6 does not sanitise and escape the id parameter before using it in a SQL stat…EPSS 1.3%7 Mar 2022 7.5CVE-2024-24867Codepress visitor statistics information exposure vulnerabilityExposure of Sensitive Information to an Unauthorized Actor vulnerability in Osamaesh WP Visitor Statistics (Real Time Traffic).This issue affects WP …EPSS 0.45%17 Mar 2024 5.4CVE-2022-4656Codepress visitor statistics cross-site scripting vulnerabilityThe WP Visitor Statistics (Real Time Traffic) WordPress plugin before 6.5 does not validate and escape one of its shortcode attributes, which could a…EPSS 0.48%13 Feb 2023 5.4CVE-2021-25042Codepress visitor statistics missing authorization vulnerabilityThe WP Visitor Statistics (Real Time Traffic) WordPress plugin before 5.5 does not have authorisation and CSRF checks in the updateIpAddress AJAX act…EPSS 0.52%28 Feb 2022 9.8CVE-2026-76461Cisco AsyncOS email parsing SQL injection allows root command executionCisco AsyncOS Software for Cisco Secure Email Gateway fails to properly validate email parsing input, allowing crafted email messages containing mali…KEVEPSS 28%analysed14 Sep 2026 9.3CVE-2026-9586Sangoma Switchvox unauthenticated SQL injection in /pa endpointSangoma Switchvox SMB Edition 8.3 (104997) fails to sanitize the PhoneIP value from XML content beginning with <PolycomIPPhone> before concatenating …KEVEPSS 19%analysed17 Jul 2026

Source: NIST National Vulnerability Database (record CVE-2021-24750), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.