38 matches found
CVE-2026-19794
The WP-Stats plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 2.56 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute...
CVE-2026-19794 WP-Stats <= 2.56 - Unauthenticated Stored Cross-Site Scripting
The WP-Stats plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 2.56 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute...
EUVD-2026-58607
The WP-Stats plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 2.56 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute...
CVE-2026-19794
The CVE-2026-19794 entry concerns the WP-Stats plugin for WordPress, affected in all versions up to and including 2.56. Root cause: insufficient input sanitization and output escaping, enabling Stored Cross-Site Scripting. Impact: unauthenticated attackers can inject arbitrary web scripts that ex...
CVE-2026-19794
The WP-Stats plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 2.56 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute...
WordPress Visitor Statistics <=5.7 - SQL Injection
WordPress Visitor Statistics plugin through 5.7 contains multiple unauthenticated SQL injection vulnerabilities. An attacker can possibly obtain sensitive information, modify data, and/or execute unauthorized administrative operations in the context of the affected site. id: CVE-2022-33965 info:...
CVE-2026-66426
Unauthenticated Cross Site Scripting XSS in WP-Stats = 2.56 versions...
CVE-2026-66426
CVE-2026-66426 affects the WordPress WP-Stats plugin (versions
CVE-2026-66426 WordPress WP-Stats plugin <= 2.56 - Cross Site Scripting (XSS) vulnerability
Unauthenticated Cross Site Scripting XSS in WP-Stats = 2.56 versions...
CVE-2026-66426
Unauthenticated Cross Site Scripting XSS in WP-Stats = 2.56 versions...
EUVD-2026-57861
Unauthenticated Cross Site Scripting XSS in WP-Stats = 2.56 versions...
WordPress WP-Stats plugin <= 2.56 - Cross Site Scripting (XSS) vulnerability
Cross Site Scripting XSS vulnerability discovered by testoun in WordPress Plugin WP-Stats versions = 2.56...
CVE-2025-67983
Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in osama.esh WP Visitor Statistics Real Time Traffic wp-stats-manager allows DOM-Based XSS.This issue affects WP Visitor Statistics Real Time Traffic: from n/a through = 8.3...
CVE-2015-9399
The wp-stats-dashboard plugin through 2.9.4 for WordPress has admin/graphtrend.php type SQL injection...
CVE-2015-10001
The WP-Stats WordPress plugin before 2.52 does not have CSRF check when saving its settings, and did not escape some of them when outputting them, allowing attacker to make logged in high privilege users change them and set Cross-Site Scripting payloads...
CVE-2015-10001
The WP-Stats WordPress plugin before 2.52 does not have CSRF check when saving its settings, and did not escape some of them when outputting them, allowing attacker to make logged in high privilege users change them and set Cross-Site Scripting payloads...
Cross site scripting
The WP-Stats WordPress plugin before 2.52 does not have CSRF check when saving its settings, and did not escape some of them when outputting them, allowing attacker to make logged in high privilege users change them and set Cross-Site Scripting payloads...
CVE-2015-10001
The CVE-2015-10001 entry concerns the WP-Stats WordPress plugin (pre-2.52). The underlying issue is the absence of CSRF checks when saving settings and incomplete escaping of output, enabling an authenticated, high-privilege user to modify settings and inject Cross-Site Scripting payloads. Affect...
CVE-2015-10001 WP-Stats < 2.5.2 - CSRF to Stored Cross-Site Scripting (XSS)
The WP-Stats WordPress plugin before 2.52 does not have CSRF check when saving its settings, and did not escape some of them when outputting them, allowing attacker to make logged in high privilege users change them and set Cross-Site Scripting payloads...