CVE-2022-50945: WordPress 3dady Real-Time Web Stats 1.0 Stored XSS

Published May 10, 2026

Updated

WordPress 3dady Real-Time Web Stats plugin 1.0 contains a stored cross-site scripting vulnerability that allows authenticated attackers to inject malicious JavaScript by exploiting unsanitized input fields. Attackers can insert JavaScript payloads in the dadyinputtext or dady2inputtext fields via the plugin options panel to execute arbitrary code when the page is viewed.

Affected Software

1 affected component

WordPress 3dady Real-Time Web Stats=1.0

Event History

May 10, 2026

CVE Published

via MITRE·12:12 PM

Data Sourced

via MITRE·12:12 PM

DescriptionSeverityWeakness

Data Sourced

via NVD·01:16 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Who can exploit this issue?

An attacker needs an authenticated WordPress account with access to the plugin's options panel. They can submit malicious JavaScript through the dady_input_text or dady2_input_text fields.

When does the injected code run?

The payload is stored in the plugin configuration and executes when a page displaying the affected content is viewed. This can affect other users who view that page.

Which inputs should be reviewed for malicious content?

Review the plugin's dady_input_text and dady2_input_text option values for unexpected JavaScript or HTML payloads. These are the fields identified as accepting unsanitized input.

CVE-2022-50945: WordPress 3dady Real-Time Web Stats 1.0 Stored XSS

Affected Software

Event History

Frequently Asked Questions

Who can exploit this issue?

When does the injected code run?

Which inputs should be reviewed for malicious content?

Company

Resources

Contact

Frequently Asked Questions

Who can exploit this issue?

When does the injected code run?

Which inputs should be reviewed for malicious content?