PT-2022-13162 · WordPress · Wp Visitor Statistics

Name of the Vulnerable Software and Affected Versions: WP Visitor Statistics Real Time Traffic versions prior to 5.6 Description: The issue concerns a SQL injection problem. It occurs because the id parameter is not properly sanitised and escaped before being used in a SQL statement via the...

WordPress plugin The WP Visitor Statistics SQL注入漏洞

WordPress is a set of blogging platforms developed using the PHP language by the Wordpress Foundation. The platform supports setting up personal blog sites on servers with PHP and MySQL. A SQL injection vulnerability exists in WordPress The WP Visitor Statistics Plugin versions prior to 5.6, whic...

CVE-2022-0410: Improper Neutralization of Special Elements used in an SQL Command

The WP Visitor Statistics Real Time Traffic WordPress plugin before 5.6 does not sanitise and escape the id parameter before using it in a SQL statement via the refUrlDetails AJAX action, available to any authenticated user, leading to a SQL injection...

WordPress WP Visitor Statistics plugin cross-site request forgery vulnerability

WordPress is a set of blogging platforms developed by the Wordpress Foundation using the PHP language. The platform supports the hosting of personal blog sites on servers with PHP and MySQL. cross-site request forgery vulnerability exists in versions of WordPress WP Visitor Statistics plugin prio...

CVE-2021-25042

The WP Visitor Statistics Real Time Traffic WordPress plugin before 5.5 does not have authorisation and CSRF checks in the updateIpAddress AJAX action, allowing any authenticated user to call it, or make a logged in user do it via a CSRF attack and add an arbitrary IP address to exclude...

CVE-2021-25042

The CVE concerns the WordPress plugin WP Visitor Statistics (Real Time Traffic) before version 5.5. The vulnerability stems from missing authorization and CSRF checks in the updateIpAddress AJAX action, allowing any authenticated user or a CSRF attacker to exclude an arbitrary IP address. Due to ...

CVE-2021-25042 WP Visitor Statistics (Real Time Traffic) < 5.5 - Arbitrary IP Address Exclusion to Stored XSS

The WP Visitor Statistics Real Time Traffic WordPress plugin before 5.5 does not have authorisation and CSRF checks in the updateIpAddress AJAX action, allowing any authenticated user to call it, or make a logged in user do it via a CSRF attack and add an arbitrary IP address to exclude...

WordPress WP Statistics plugin cross-site scripting vulnerability (CNVD-2022-46465)

WordPress is the Wordpress Foundation's set of blogging platform developed using the PHP language. WordPress plugin is a WordPress open source application plugin. WordPress WP Statistics plugin 13.1.5 and earlier versions have a cross-site scripting vulnerability that can be exploited by attacker...

WordPress WP Statistics plugin跨站脚本漏洞

WordPress is a set of blogging platforms developed by the Wordpress Foundation using the PHP language. The platform supports personal blogging sites on PHP and MySQL servers. WordPress WP Statistics plugin 13.1.5 and earlier versions have a cross-site scripting vulnerability that can be exploited...

Trellix “Catmen Sanfrancisco” Capture the Flag Results!

Trellix “Catmen Sanfrancisco” Capture the Flag Results! By Trellix · February 28, 2022 This story was written by Steve Povolny. And just like that, it’s all over! Our annual Capture the Flag contest expired at 11:59pm PST, on February 25th. We wanted to take a moment to thank all of our...

WordPress Import Social Statistics plugin <= 1.0.2 - Sensitive Information Disclosure vulnerability

Sensitive Information Disclosure vulnerability discovered in WordPress Import Social Statistics plugin versions = 1.0.2. Solution No patched version available...

WordPress Import Social Statistics plugin <= 1.0.2 - Toggle The Debug Mode via Cross-Site Request Forgery (CSRF) vulnerability

Toggle The Debug Mode via Cross-Site Request Forgery CSRF vulnerability discovered in WordPress Import Social Statistics plugin versions = 1.0.2. Solution No patched version available...

WordPress WP Statistics plugin SQL注入漏洞（CNVD-2022-46466）

WordPress is the Wordpress Foundation's set of blogging platform developed using the PHP language. WordPress plugin is a WordPress open source application plugin. WordPress WP Statistics plugin 13.1.5 and earlier versions are vulnerable to SQL injection, which can be exploited by attackers to...

PT-2022-9598

Name of the Vulnerable Software and Affected Versions WP Visitor Statistics Real Time Traffic versions prior to 5.5 Description The issue concerns a lack of authorization and CSRF checks in the updateIpAddress AJAX action. This allows any authenticated user to call the action or make a logged-in...

WordPress plugin WP Visitor Statistics 安全漏洞

WordPress is a set of blogging platforms developed by the Wordpress Foundation using the PHP language. The platform supports the hosting of personal blog sites on servers with PHP and MySQL. cross-site request forgery vulnerability exists in versions of WordPress WP Visitor Statistics plugin prio...

Trellix “Catmen Sanfrancisco” Capture the Flag Results!

Trellix “Catmen Sanfrancisco” Capture the Flag Results! By Trellix · February 28, 2022 This story was written by Steve Povolny. And just like that, it’s all over! Our annual Capture the Flag contest expired at 11:59pm PST, on February 25th. We wanted to take a moment to thank all of our...

CVE-2021-25042: Missing Authorization

The WP Visitor Statistics Real Time Traffic WordPress plugin before 5.5 does not have authorisation and CSRF checks in the updateIpAddress AJAX action, allowing any authenticated user to call it, or make a logged in user do it via a CSRF attack and add an arbitrary IP address to exclude...

File Descriptor Leak

Possible sensitive files Vulnerability description: A possible sensitive file has been found. This file is not directly linked from the website. This check looks for common sensitive resources like password files, configuration files, log files, include files, statistics data, database dumps. Eac...

WordPress and WordPress plugin cross-site scripting vulnerability

WordPress is the Wordpress Foundation's set of blogging platform developed using the PHP language. WordPress plugin is a WordPress open source application plugin. WordPress plugin WP Statistics has a cross-site scripting vulnerability that can be exploited by an attacker to inject arbitrary web...

WordPress WP Statistics plugin SQL注入漏洞

WordPress is a blogging platform developed by the WordPress Wordpress Foundation using the PHP language. The platform supports setting up personal blog sites on PHP and MySQL servers. WordPress WP Statistics plugin is vulnerable to SQL injection, which can be used by unauthenticated attackers to...