CVE-2021-41836

The Fathom Analytics WordPress plugin is vulnerable to Stored Cross-Site Scripting due to insufficient input validation and escaping via the $site_id parameter found in the ~/fathom-analytics.php file which allowed attackers with administrative user access to inject arbitrary web scripts, in versions up to and including 3.0.4. This affects multi-site installations where unfiltered_html is disabled for administrators, and sites where unfiltered_html is disabled.

• CWE-79

• https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=2641005%40fathom-analytics&new=2641005%40fathom-analytics&sfp_email=&sfph_mail=Patch, Third Party Advisory
• https://www.wordfence.com/vulnerability-advisories/#CVE-2021-41836Third Party Advisory
• https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=2641005%40fathom-analytics&new=2641005%40fathom-analytics&sfp_email=&sfph_mail=Patch, Third Party Advisory
• https://www.wordfence.com/vulnerability-advisories/#CVE-2021-41836Third Party Advisory

Published

Dec 14, 2021

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2021-41830It is possible for an attacker to manipulate signed document…7.5
• CVE-2021-41831It is possible for an attacker to manipulate the timestamp o…5.3
• CVE-2021-41832It is possible for an attacker to manipulate documents to ap…7.5
• CVE-2021-41833Zoho ManageEngine Patch Connect Plus before 90099 is vulnera…9.8
• CVE-2021-41834JFrog Artifactory prior to version 7.28.0 and 6.23.38, is vu…6.5
• CVE-2021-41835Fresenius Kabi Agilia Link + version 3.0 does not enforce tr…7.5
• CVE-2021-41837An issue was discovered in AhciBusDxe in the kernel 5.0 thro…8.2
• CVE-2021-41838An issue was discovered in SdHostDriver in the kernel 5.0 th…8.2
• CVE-2021-41839An issue was discovered in NvmExpressDxe in the kernel 5.0 t…8.2
• CVE-2021-4184Infinite loop in the BitTorrent DHT dissector in Wireshark 3…7.5
• CVE-2021-41840An issue was discovered in NvmExpressDxe in the kernel 5.0 t…8.2
• CVE-2021-41841An issue was discovered in AhciBusDxe in the kernel 5.0 thro…8.2