CVE-2022-50945
MediumCVSS 6.4Exploitation Probability (EPSS)
Low risk12th percentile - higher than 12% of all known CVEs
Summary
WordPress 3dady Real-Time Web Stats plugin version 1.0 contains a stored cross-site scripting vulnerability that allows authenticated attackers to inject malicious JavaScript via unsanitized input fields. Attackers can inject JavaScript payloads in the dady_input_text or dady2_input_text fields in the plugin options panel, leading to code execution when the page is viewed.
Risk Assessment
The risk includes arbitrary JavaScript execution in the victim's browser, which could lead to session theft, account takeover, or other malicious actions.
Recommendation
It is recommended to immediately update the plugin to the latest version or remove it if no patch is available.
Original NVD description (English source)
WordPress 3dady Real-Time Web Stats plugin 1.0 contains a stored cross-site scripting vulnerability that allows authenticated attackers to inject malicious JavaScript by exploiting unsanitized input fields. Attackers can insert JavaScript payloads in the dady_input_text or dady2_input_text fields via the plugin options panel to execute arbitrary code when the page is viewed.