CVE-2023-0955

2023-03-2716:15:09

Google

osv.dev

8 High

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

30.8%

JSON

The WP Statistics WordPress plugin before 14.0 does not escape a parameter, which could allow authenticated users to perform SQL Injection attacks. By default, the affected feature is available to users with the manage_options capability (admin+), however the plugin has a settings to allow low privilege users to access it as well.

CPENameOperatorVersion
wp-statisticseq13.2.3
wp-statisticseq12.3.6.4
wp-statisticseq12.1.0
wp-statisticseq13.2.4.1
wp-statisticseq12.3.6.1
wp-statisticseq12.6.10
wp-statisticseq12.0.11
wp-statisticseq12.6.7
wp-statisticseq13.0.7
wp-statisticseq12.4.0

Name	Operator	Version
wp-statistics	eq	13.2.3
wp-statistics	eq	12.3.6.4
wp-statistics	eq	12.1.0
wp-statistics	eq	13.2.4.1
wp-statistics	eq	12.3.6.1
wp-statistics	eq	12.6.10
wp-statistics	eq	12.0.11
wp-statistics	eq	12.6.7
wp-statistics	eq	13.0.7
wp-statistics	eq	12.4.0