Lucene search

WordfenceCVELIST:CVE-2022-25306

HistoryFeb 24, 2022 - 6:27 p.m.

CVE-2022-25306 WP Statistics <= 13.1.5 Unauthenticated Stored Cross-Site Scripting via browser

2022-02-2418:27:09

CWE-79

Wordfence

www.cve.org

cve-2022-25306

unauthenticated

stored cross-site scripting

CVSS3

7.2

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N

AI Score

7.2

Confidence

High

EPSS

0.002

Percentile

52.6%

JSON

The WP Statistics WordPress plugin is vulnerable to Cross-Site Scripting due to insufficient escaping and sanitization of the browser parameter found in the ~/includes/class-wp-statistics-visitor.php file which allows attackers to inject arbitrary web scripts onto several pages that execute when site administrators view a sites statistics, in versions up to and including 13.1.5.

CNA Affected

[
  {
    "product": "WP Statistics",
    "vendor": "WP Statistics",
    "versions": [
      {
        "lessThanOrEqual": "13.1.5",
        "status": "affected",
        "version": "13.1.5",
        "versionType": "custom"
      }
    ]
  }
]

References

gist.github.com/Xib3rR4dAr/89fc87ea1d62348c21c99fc11a3bfd88

plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=2679983%40wp-statistics&new=2679983%40wp-statistics&sfp_email=&sfph_mail=

www.wordfence.com/vulnerability-advisories/#CVE-2022-25306

CVSS3

7.2

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N

AI Score

7.2

Confidence

High

EPSS

0.002

Percentile

52.6%

JSON

Related for CVELIST:CVE-2022-25306