Hotjar

Hotjar has one disclosed vulnerability in the WordSec catalog, all reported in 2023; it is fixed as of September 2026. Their average CVSS score is 4.4, and the most serious one scores 4.4 out of 10.

The most common weakness is Cross-Site Scripting, behind 1 of the records (100%).

The one issue recorded for Hotjar has a vendor fix available, so running the current release closes it.

All of these findings were reported by Marco Wotschka. Hotjar is installed on roughly 70,000 WordPress sites, so each unpatched flaw has a wide blast radius. The current release is tested up to WordPress 6.0.14.

Strategic Overview

Avg CVSSMedium
4.4/ 10
Patch Coverage100%
Open

0

Fixed

1

Get automatic notifications for all Hotjar vulnerabilities before they are exploited.

Highest severity on recordCVSS 4.4CVE-2023-1259

Hotjar <= 1.0.15 - Authenticated (Administrator+) Stored Cross-Site Scripting

Read the full analysis

Vulnerability Records

1 records
Hotjar banner
Latestv1.0.16
2.9(18)
58/100
Last Updated
2023-10-25 (3y ago)
Active Installs
70,000+
Downloads
1,098,707
Requires WP
4.6+
Requires PHP
0+
Tested up to
WP 6.0.14
Created
2019-01-16 (8y ago)

Hotjar helps you to connect the dots between what your users do and why—so you can confidently create and optimize user experiences that convert. See what your users see, ask how they feel, and connect 1:1, all from one powerful and intuitive platform. Hotjar Observe: Visualize user behavior – Heatmaps visually represent where users click, move, and scroll on your site. With this context, you’ll be inspired with simple ways to improve your site. Put yourself in their shoes – Watch recordings of real user behavior on your site. See visitors’ clicks, mouse movements, u-turns, and rage clicks. Learn what frustrates users and resolve issues early. Measure conversions and learn why users drop off – Visualize your conversion flows with Funnels, and understand where your users are getting stuck by zooming into relevant recordings. Explore and understand your metrics – Trends connects the dots between numbers and user behavior insights so you can visualize your most important metrics and find the recordings and heatmaps of the underlying user behavior with a single click. Hotjar Ask: Hear from your users – Surveys bring voice-of-customer to your decision-making. Gathering evidence for a landing page or feature? Use a targeted Survey to validate your ideas and better understand your users. Get feedback with context – A real-time suggestion box on your site, Feedback lets users express frustration or delight about individual parts of your site, right down to the page, form, or image they’re looking at. Hotjar Engage: Connect with users – Automate the recruitment, scheduling, and hosting of moderated user interviews, and focus on what matters the most—connecting with users. Hotjar Platform: Stay on top of your user metrics – Use your Dashboard to get a high-level view of user data and spot issues before they become serious, identify trends, and find deeper insights. Integrate Hotjar with the tools you love – Connect Hotjar with thousands of popular apps, so you can automate your work and have more time for what matters most—no code required. This plugin provides a simple installation of Hotjar on your WordPress site. Sign-up for your free trial today!

Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C