Lucene search
+L

229 matches found

Nuclei
Nuclei
added 2026/08/27 4:24 a.m.112 views

WordPress Plugin WP Statistics <= 13.1.5 - SQL Injection

The WP Statistics WordPress plugin is vulnerable to SQL Injection due to insufficient escaping and parameterization of the currentpagetype parameter found in the /includes/class-wp-statistics-hits.php file which allows attackers without authentication to inject arbitrary SQL queries to obtain...

9.8CVSS8AI score0.32212EPSS
SaveExploits1References5
Nuclei
Nuclei
added 2026/08/27 4:24 a.m.88 views

WordPress Plugin WP Statistics <= 13.1.5 - SQL Injection

The WP Statistics WordPress plugin is vulnerable to SQL Injection due to insufficient escaping and parameterization of the IP parameter found in the /includes/class-wp-statistics-hits.php file which allows attackers without authentication to inject arbitrary SQL queries to obtain sensitive...

9.8CVSS8.5AI score0.77956EPSS
SaveExploits1References5
Kitploit
Kitploit
added 2026/08/27 2:41 a.m.2 views

CVE-2025-9816

CVE-2025-9816 WP-Statistics 插件上的存储型 XSS 扫描器(检测与 PoC) “WP Statistics – The Most Popular Privacy-Friendly Analytics Plugin 插件(用于 WordPress)在包括 14.5.4 在内的所有版本中,由于对输入清理和输出转义不足,存在通过 User-Agent 头进行的存储型跨站脚本漏洞。这使得未经身份验证的攻击者能够在页面中注入任意 Web 脚本,当用户访问被注入的页面时这些脚本将执行。” 如何使用 root@kitploit: use virtual enviroment...

7.2CVSS5.2AI score0.09051EPSS
SaveExploits0
Patchstack
Patchstack
added 2026/08/20 11:09 a.m.8 views

WordPress WP Statistics plugin <= 14.16.8 - Unauthenticated Stored Cross-Site Scripting via 'utm_campaign' Parameter vulnerability

Unauthenticated Stored Cross-Site Scripting via 'utmcampaign' Parameter vulnerability discovered by tipsen in WordPress Plugin WP Statistics versions = 14.16.8...

7.2CVSS5.1AI score0.00394EPSS
SaveExploits0References1Affected Software1
NVD
NVD
added 2026/08/19 7:16 a.m.6 views

CVE-2026-15780

The WP Statistics – Simple, privacy-friendly Google Analytics alternative plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'utmcampaign' parameter in all versions up to, and including, 14.16.8 due to insufficient input sanitization and output escaping. This makes it...

7.2CVSS0.00394EPSS
SaveExploits0References14
EUVD
EUVD
added 2026/08/19 6:37 a.m.8 views

EUVD-2026-62341

The WP Statistics – Simple, privacy-friendly Google Analytics alternative plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'utmcampaign' parameter in all versions up to, and including, 14.16.8 due to insufficient input sanitization and output escaping. This makes it...

7.2CVSS5.7AI score0.00394EPSS
SaveExploits0References14
Cvelist
Cvelist
added 2026/08/19 6:37 a.m.35 views

CVE-2026-15780 WP Statistics <= 14.16.8 - Unauthenticated Stored Cross-Site Scripting via 'utm_campaign' Parameter

The WP Statistics – Simple, privacy-friendly Google Analytics alternative plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'utmcampaign' parameter in all versions up to, and including, 14.16.8 due to insufficient input sanitization and output escaping. This makes it...

7.2CVSS0.00394EPSS
SaveExploits0References14
OSV
OSV
added 2026/08/19 6:37 a.m.18 views

CVE-2026-15780 WP Statistics <= 14.16.8 - Unauthenticated Stored Cross-Site Scripting via 'utm_campaign' Parameter

The WP Statistics – Simple, privacy-friendly Google Analytics alternative plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'utmcampaign' parameter in all versions up to, and including, 14.16.8 due to insufficient input sanitization and output escaping. This makes it...

7.2CVSS5.8AI score
SaveExploits0References16
CVE
CVE
added 2026/08/19 6:37 a.m.42 views

CVE-2026-15780

CVE-2026-15780 is an unauthenticated Stored Cross-Site Scripting vulnerability in the WP Statistics WordPress plugin (all versions ≤ 14.16.8). The root cause is insufficient input sanitization and output escaping of the utm_campaign parameter. Attackers can plant a malicious payload without authe...

7.2CVSS5.7AI score0.00394EPSS
SaveIn wildExploits0References14
NVD
NVD
added 2026/08/08 7:17 a.m.16 views

CVE-2026-16562

The WP Statistics WordPress plugin before 14.16.10 does not perform a capability check on a set of dashboard analytics AJAX handlers, relying only on a nonce that every authenticated user holds, allowing users with Subscriber-level access and above to disclose the site's visitor analytics data...

6.5CVSS0.00219EPSS
SaveExploits0References1
ATTACKERKB
ATTACKERKB
added 2026/08/08 6:00 a.m.9 views

CVE-2026-16562

The WP Statistics WordPress plugin before 14.16.10 does not perform a capability check on a set of dashboard analytics AJAX handlers, relying only on a nonce that every authenticated user holds, allowing users with Subscriber-level access and above to disclose the site's visitor analytics data...

5.2AI score0.00219EPSS
SaveExploits0References1
NVD
NVD
added 2026/06/01 3:16 p.m.24 views

CVE-2026-48839

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in VeronaLabs WP Statistics allows DOM-Based XSS. This issue affects WP Statistics: from n/a through 14.16.6...

7.1CVSS0.00212EPSS
SaveExploits0References1
Vulnrichment
Vulnrichment
added 2026/06/01 2:43 p.m.19 views

CVE-2026-48839 WordPress WP Statistics plugin <= 14.16.6 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in VeronaLabs WP Statistics allows DOM-Based XSS. This issue affects WP Statistics: from n/a through 14.16.6...

7.1CVSS5.8AI score0.00212EPSS
SaveExploits0References1
ATTACKERKB
ATTACKERKB
added 2026/06/01 2:43 p.m.26 views

CVE-2026-48839

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in VeronaLabs WP Statistics allows DOM-Based XSS. This issue affects WP Statistics: from n/a through 14.16.6...

7.1CVSS5.8AI score0.00212EPSS
SaveExploits0References2
Patchstack
Patchstack
added 2026/06/01 9:43 a.m.18 views

WordPress WP Statistics plugin <= 14.16.6 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by daroo in WordPress Plugin WP Statistics versions = 14.16.6...

7.1CVSS5.8AI score0.00212EPSS
SaveExploits0Affected Software1
Patchstack
Patchstack
added 2026/04/17 9:26 a.m.12 views

WordPress WP Statistics plugin <= 14.16.4 - Missing Authorization to Authenticated (Subscriber+) Sensitive Information Exposure and Privacy Audit Manipulation vulnerability

Missing Authorization to Authenticated Subscriber+ Sensitive Information Exposure and Privacy Audit Manipulation vulnerability discovered by Jack Pas Dark. - Black Lantern Security in WordPress Plugin WP Statistics versions = 14.16.4...

6.5CVSS5.8AI score0.00312EPSS
SaveExploits0References1Affected Software1
NVD
NVD
added 2026/04/17 2:16 a.m.26 views

CVE-2026-5231

The WP Statistics plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'utmsource' parameter in all versions up to, and including, 14.16.4. This is due to insufficient input sanitization and output escaping. The plugin's referral parser copies the raw utmsource value into the...

7.2CVSS0.00476EPSS
SaveExploits0References6
NVD
NVD
added 2026/04/17 2:16 a.m.15 views

CVE-2026-3488

The WP Statistics plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 14.16.4. This is due to missing capability checks on multiple AJAX handlers including wpstatisticsgetfilters, wpstatisticsgetPrivacyStatus, wpstatisticsupdatePrivacyStatus, and...

6.5CVSS0.00312EPSS
SaveExploits0References9
EUVD
EUVD
added 2026/04/17 1:24 a.m.21 views

EUVD-2026-23342

The WP Statistics plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'utmsource' parameter in all versions up to, and including, 14.16.4. This is due to insufficient input sanitization and output escaping. The plugin's referral parser copies the raw utmsource value into the...

7.2CVSS5.9AI score0.00476EPSS
SaveExploits0References6
Vulnrichment
Vulnrichment
added 2026/04/17 1:24 a.m.13 views

CVE-2026-3488 WP Statistics <= 14.16.4 - Missing Authorization to Authenticated (Subscriber+) Sensitive Information Exposure and Privacy Audit Manipulation

The WP Statistics plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 14.16.4. This is due to missing capability checks on multiple AJAX handlers including wpstatisticsgetfilters, wpstatisticsgetPrivacyStatus, wpstatisticsupdatePrivacyStatus, and...

6.5CVSS5.7AI score0.00312EPSS
SaveExploits0References9
Rows per page
Query Builder