CVE-2019-13275

An issue was discovered in the VeronaLabs wp-statistics plugin before 12.6.7 for WordPress. The v1/hit endpoint of the API, when the non-default "use cache plugin" setting is enabled, is vulnerable to unauthenticated blind SQL Injection...

Sql injection

An issue was discovered in the VeronaLabs wp-statistics plugin before 12.6.7 for WordPress. The v1/hit endpoint of the API, when the non-default "use cache plugin" setting is enabled, is vulnerable to unauthenticated blind SQL Injection...

CVE-2019-13275

The CVE-2019-13275 issue affects VeronaLabs wp-statistics plugin for WordPress up to version 12.6.7, where the v1/hit endpoint is vulnerable to unauthenticated blind SQL Injection when the non-default “use cache plugin” setting is enabled. Multiple connected sources (NVD, Red Hat, OSV, CNVD, etc....

CVE-2019-13275

An issue was discovered in the VeronaLabs wp-statistics plugin before 12.6.7 for WordPress. The v1/hit endpoint of the API, when the non-default "use cache plugin" setting is enabled, is vulnerable to unauthenticated blind SQL Injection...

CVE-2019-13275

An issue was discovered in the VeronaLabs wp-statistics plugin before 12.6.7 for WordPress. The v1/hit endpoint of the API, when the non-default "use cache plugin" setting is enabled, is vulnerable to unauthenticated blind SQL Injection...

WordPress WP Statistics plugin <= 12.6.6.1 - Unauthenticated Stored Cross-Site Scripting (XSS) vulnerability

Unauthenticated Stored Cross-Site Scripting XSS vulnerability found by Antony Garand in WordPress WP Statistics plugin version = 12.6.6.1. The specific configuration needed for exploitation. Solution Update the WordPress WP Statistics plugin to the latest available version at least 12.6.7...

PT-2019-13229

Name of the Vulnerable Software and Affected Versions VeronaLabs wp-statistics plugin versions prior to 12.6.7 Description An issue was discovered in the plugin, where the "v1/hit" endpoint of the API is vulnerable to unauthenticated blind SQL Injection when the non-default "use cache plugin"...

CVE-2019-13275: Improper Neutralization of Special Elements used in an SQL Command

An issue was discovered in the VeronaLabs wp-statistics plugin before 12.6.7 for WordPress. The v1/hit endpoint of the API, when the non-default "use cache plugin" setting is enabled, is vulnerable to unauthenticated blind SQL Injection...

WP Statistics <= 12.6.6.1 - Unauthenticated Blind SQL Injection

An endpoint of the API, which is exposed when the 'use cache plugin' setting is enabled by default disabled, is vulnerable to an unauthenticated blind SQLi issue. time curl -X POST 'http://host/wp-json/wpstatistics/v1/hit' --data...

WP Statistics <= 12.6.6.1 - Unauthenticated Blind SQL Injection

An endpoint of the API, which is exposed when the 'use cache plugin' setting is enabled by default disabled, is vulnerable to an unauthenticated blind SQLi issue. PoC time curl -X POST 'http://host/wp-json/wpstatistics/v1/hit' --data...

WordPress WP Statistics plugin <= 12.6.5 - Authenticated Stored Cross-Site Scripting (XSS) vulnerability

Authenticated Stored Cross-Site Scripting XSS vulnerability found by kuqadk3 in WordPress WP Statistics plugin versions = 12.6.5. Solution Update the WordPress WP Statistics plugin to the latest available version at least 12.6.6.1...

Cross site scripting

The WP Statistics plugin through 12.6.5 for Wordpress has stored XSS in includes/class-wp-statistics-pages.php. This is related to an account with the Editor role creating a post with a title that contains JavaScript, to attack an admin user...

CVE-2019-12566

The WP Statistics plugin through 12.6.5 for Wordpress has stored XSS in includes/class-wp-statistics-pages.php. This is related to an account with the Editor role creating a post with a title that contains JavaScript, to attack an admin user...

CVE-2019-12566

The WP Statistics plugin through 12.6.5 for Wordpress has stored XSS in includes/class-wp-statistics-pages.php. This is related to an account with the Editor role creating a post with a title that contains JavaScript, to attack an admin user...

CVE-2019-12566

The CVE-2019-12566 entry concerns the WordPress WP Statistics plugin (versions up to 12.6.5). The vulnerability is an authenticated stored cross-site scripting (XSS) flaw in includes/class-wp-statistics-pages.php, exploitable when an Editor creates a post whose title contains JavaScript, with the...

CVE-2019-12566

The WP Statistics plugin through 12.6.5 for Wordpress has stored XSS in includes/class-wp-statistics-pages.php. This is related to an account with the Editor role creating a post with a title that contains JavaScript, to attack an admin user...

CVE-2019-12566: Improper Neutralization of Input During Web Page Generation

The WP Statistics plugin through 12.6.5 for Wordpress has stored XSS in includes/class-wp-statistics-pages.php. This is related to an account with the Editor role creating a post with a title that contains JavaScript, to attack an admin user...

PT-2019-12856

Name of the Vulnerable Software and Affected Versions WP Statistics plugin versions prior to 12.6.6 Description The issue is related to stored XSS in the includes/class-wp-statistics-pages.php file. It can be exploited when an account with the Editor role creates a post with a title containing...

CVE-2019-10864

The WP Statistics plugin through 12.6.2 for WordPress has XSS, allowing a remote attacker to inject arbitrary web script or HTML via the Referer header of a GET request...

CVE-2019-10864

CVE-2019-10864 affects the WordPress WP Statistics plugin (up to version 12.6.2; referenced in multiple sources up to 12.6.3). The vulnerability is a cross-site scripting (XSS) flaw that allows a remote attacker to inject arbitrary web script or HTML via the Referer header on a GET request. The O...