CVE-2022-4541 HIGH

CVE-2022-4541: WordPress Visitors <= 1.0 - Unauthenticated Stored Cross-Site Scripting via HTTP Header

Vendor Nitinmaurya12
Product WordPress Visitors
Weakness CWE-79 · XSS
Published September 26, 2024
Last update April 8, 2026
View on NVD All CVEs

CVSS base score

7.2/10
Attack vector Network
Attack complexity Low
Privileges required None
User interaction None
Confidentiality Low
Integrity Low

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N

What the vulnerability does

01Description

The WordPress Visitors plugin for WordPress is vulnerable to Stored Cross-Site Scripting via a spoofed HTTP Header value in versions up to, and including, 1.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses the nm_vistior page.

Key dates

02Disclosure timeline

September 26, 2024 CVE published
April 8, 2026 Record updated

Related vulnerabilities

04Related CVE

CVE-2025-57940 WordPress Append extensions on Pages Plugin <= 1.1.2 - Cross Site Scripting (XSS) Vulnerability CVE-2024-43308 WordPress Gutentor – Gutenberg Blocks – Page Builder for Gutenberg Editor plugin <= 3.3.5 - Cross Site Scripting (XSS) vulnerability CVE-2024-11660 code-projects Farmacia usuario.php cross site scripting CVE-2016-9465 CVE-2024-9092 SourceCodester Profile Registration without Reload Refresh Registration Form add.php cross site scripting