Microsoft Clarity vulnerabilities

2 CVEs affecting Microsoft Clarity, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2024-0590, published 2024-02-29.

More from Microsoft.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

• CVE-2021-33850, published 2021-11-19. Medium severity, CVSS 5.4. EPSS: 1.6% chance of exploitation in the next 30 days. There is a Cross-Site Scripting vulnerability in Microsoft Clarity version 0.3. The XSS payload executes whenever the user changes the clarity configuration in Microsoft Clarity version 0.3. The…
• CVE-2024-0590, published 2024-02-29. Medium severity, CVSS 6.1. EPSS: 1.3% chance of exploitation in the next 30 days. The Microsoft Clarity plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 0.9.3. This is due to missing nonce validation on the…