What this actually is.
Technical background, root cause, and affected surface.
A Cross-Site Scripting vulnerability in Microsoft Clarity version 0.3 can cause arbitrary code to run in a user’s browser while the browser is connected to a trusted website. The XSS payload executes whenever the user changes the clarity configuration in Microsoft Clarity version 0.3 stored on the configuring project ID page.
- Vendor
- Microsoft
- Affected Product
- Microsoft Clarity version 0.3
- CVE
- CVE-2021-33850
- Securin ID
- 2020-CSW-10-1050
- Status
- Fixed
- Date
- October 18, 2021
- Severity
- Medium
- CVSS Score
- 5.4
- Vector
- CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
- CWE
- CWE-79
From one request
to root shell.
Reproduced in a sandboxed environment. Requires only LAN or WiFi adjacency.
The following vulnerability was detected in WordPress Microsoft Clarity Plugin version 0.3.
What an attacker does to you.
Post-exploitation outcomes mapped to CVSS impact metrics.
An attacker can control a script executed in the victim’s browser and fully compromise the targeted user. In addition, an XSS vulnerability enables attacks that are contained within the application itself. There is no need to find an external way of inducing the victim to make a request containing their exploit. Instead, the attacker places the exploit inside the application itself and simply waits for users to encounter it, thus, resulting in the following:
Stealing cookies,
End-user files disclosure,
Installation of Trojan horse programs,
Redirection of the user to some other page or site.
Fix it. In this order.
A runbook, not a checklist. Sequence matters — assume compromise before you act.
Perform context-sensitive encoding of untrusted input before it is echoed back to a browser by using the encoding library.
Implement input validation for special characters on all the variables reflected in the browser and stored in the database.
Implement client-side validation.
Figure 5: Cross-Site Scripting Mitigation Setting in the wp.config File Prevents Cross-site Scripting Attacks
disclose@securin.ioVendors moved in days.
Attackers in hours.
Reconstructed from vendor advisories, CISA bulletins, and Securin research records.
Discovered in Microsoft Clarity version 0.3
Reported to WordPress Team.
WordPress acknowledged.
Microsoft Clarity Plugin fixed the issue.
CSW Assigned the CVE Identifier [CVE-2021-33850]
Timeline recorded · Disclosure coordinated by Securin
Cite, verify, go deeper.
Primary sources — NVD, CISA KEV, and machine-readable IoC feed.