Read the docs

WP Statistics

Records10All Threatist records
Exploited (KEV)0None in CISA KEV
CVSS critical3CVSS 9.0–10.0
CVSS high3CVSS 7.0–8.9

Exploited now

WP Statistics records in CISA KEV

No WP Statistics vulnerabilities are listed in CISA KEV.

Components

Products in the NVD configurations · select one to filter the records
Wp Statistics 3 records LOW

Records

10 records

TI-2022-08862 CVE-2022-25149 · GHSA-gmjf-vvgp-p553

WP Statistics <= 13.1.5 Unauthenticated Blind SQL Injection via IP

Priority CRITICAL 88

The WP Statistics WordPress plugin is vulnerable to SQL Injection due to insufficient escaping and parameterization of the IP parameter found in the ~/includes/class-wp-statistics-hits.php file which allows attackers wit…

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.77459 Published 2022-02-24 No fix listed CWE-89
TI-2022-08861 CVE-2022-25148 · GHSA-wg9m-p2x3-fg97

WP Statistics <= 13.1.5 Unauthenticated Blind SQL Injection via current_page_id

Priority HIGH 82

The WP Statistics WordPress plugin is vulnerable to SQL Injection due to insufficient escaping and parameterization of the current_page_id parameter found in the ~/includes/class-wp-statistics-hits.php file which allows…

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.8093 Published 2022-02-24 No fix listed CWE-89
TI-2022-08998 CVE-2022-25305 · GHSA-vm77-69v7-mqr2

WP Statistics <= 13.1.5 Unauthenticated Stored Cross-Site Scripting via IP

Priority HIGH 77

The WP Statistics WordPress plugin is vulnerable to Cross-Site Scripting due to insufficient escaping and sanitization of the IP parameter found in the ~/includes/class-wp-statistics-ip.php file which allows attackers to…

CVSS 3.1HIGH 7.2 Network No auth No interaction EPSS 0.78905 Published 2022-02-24 No fix listed CWE-79
TI-2022-00567 CVE-2022-0651 · GHSA-hx7h-9675-wcgc

WP Statistics <= 13.1.5 Unauthenticated Blind SQL Injection via current_page_type

Priority HIGH 73

The WP Statistics WordPress plugin is vulnerable to SQL Injection due to insufficient escaping and parameterization of the current_page_type parameter found in the ~/includes/class-wp-statistics-hits.php file which allow…

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.32212 Published 2022-02-24 No fix listed CWE-89
TI-2022-09000 CVE-2022-25307 · GHSA-rx84-8xr7-vgxm

WP Statistics <= 13.1.5 Unauthenticated Stored Cross-Site Scripting via platform

Priority MEDIUM 40

The WP Statistics WordPress plugin is vulnerable to Cross-Site Scripting due to insufficient escaping and sanitization of the platform parameter found in the ~/includes/class-wp-statistics-hits.php file which allows atta…

CVSS 3.1HIGH 7.2 Network No auth No interaction EPSS 0.01378 Published 2022-02-24 No fix listed CWE-79
TI-2022-08999 CVE-2022-25306 · GHSA-224h-mqw6-642p

WP Statistics <= 13.1.5 Unauthenticated Stored Cross-Site Scripting via browser

Priority MEDIUM 40

The WP Statistics WordPress plugin is vulnerable to Cross-Site Scripting due to insufficient escaping and sanitization of the browser parameter found in the ~/includes/class-wp-statistics-visitor.php file which allows at…

CVSS 3.1HIGH 7.2 Network No auth No interaction EPSS 0.01378 Published 2022-02-24 No fix listed CWE-79
TI-2017-01439 CVE-2017-2136 · GHSA-9mcw-hh47-x3v4

Cross-site scripting in WP Statistics

Priority LOW 32

Cross-site scripting vulnerability in WP Statistics version 12.0.4 and earlier allows remote attackers to inject arbitrary web script or HTML via specially crafted HTTP Referer headers.

CVSS 3.0MEDIUM 6.1 Network No auth User interaction EPSS 0.02603 Published 2017-04-28 No fix listed CWE-79
TI-2017-01438 CVE-2017-2135 · GHSA-p367-x79q-2576

Cross-site scripting in WP Statistics

Priority LOW 31

Cross-site scripting vulnerability in WP Statistics version 12.0.1 and earlier allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

CVSS 3.0MEDIUM 6.1 Network No auth User interaction EPSS 0.01678 Published 2017-04-28 No fix listed CWE-79
TI-2017-01450 CVE-2017-2147 · GHSA-25rw-5w3f-v9vr

Cross-site scripting in WP Statistics

Priority LOW 30

Cross-site scripting vulnerability in WP Statistics version 12.0.4 and earlier allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

CVSS 3.0MEDIUM 6.1 Network No auth User interaction EPSS 0.01278 Published 2017-04-28 No fix listed CWE-79
Open these records in search →