Buffer overflow

The WP Statistics WordPress plugin before 13.0.8 relied on using the WordPress escsql function on a field not delimited by quotes and did not first prepare the query. Additionally, the page, which should have been accessible to administrator only, was also available to any visitor, including...

CVE-2021-24340 WP Statistics < 13.0.8 - Unauthenticated SQL Injection

The WP Statistics WordPress plugin before 13.0.8 relied on using the WordPress escsql function on a field not delimited by quotes and did not first prepare the query. Additionally, the page, which should have been accessible to administrator only, was also available to any visitor, including...

CVE-2021-24340

The WordPress WP Statistics plugin (versions prior to 13.0.8) is affected by an unauthenticated time-based blind SQL injection. Root cause: the plugin used esc_sql() on a field not delimited by quotes and did not first prepare the query, with an admin page exposed to unauthenticated visitors. Imp...

WP Statistics Bug Lets Attackers Lift Sites’ Data

WP Statistics, a plugin installed on more than 600,000 WordPress websites, has an SQL-injection security vulnerability that could let site visitors make off with all kinds of sensitive information from web databases, including emails, credit-card data, passwords and more. WP Statistics, as its na...

WordPress WP Statistics 13.0.7 Plugin - Time-Based Blind SQL Injection Vulnerability

Exploit Title: WordPress Plugin WP Statistics 13.0.7 - Time-Based Blind SQL Injection Unauthenticated Date: 20/05/2021 Exploit Author: Mansoor R @time4ster CVSS Score: 7.5 High CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N Version Affected: 13.0 to 13.0.7 Vendor URL:...

WP Statistics < 13.0.8 - Unauthenticated SQL Injection

The plugin relied on using the WordPress escsql function on a field not delimited by quotes and did not first prepare the query. Additionally, the page, which should have been accessible to administrator only, was also available to any visitor, including unauthenticated ones...

CVE-2017-18515

The wp-statistics plugin before 12.0.8 for WordPress has SQL injection...

CVE-2017-18515

The wp-statistics plugin before 12.0.8 for WordPress has SQL injection...

Sql injection

The wp-statistics plugin before 12.0.8 for WordPress has SQL injection...

CVE-2017-18515

CVE-2017-18515 affects the WordPress WP Statistics plugin prior to version 12.0.8, exposing an SQL injection vulnerability in that plugin (VendorFix remediation). NVD, Red Hat and OpenVAS references document the issue with CVSS/impact details and indicate upgrading to 12.0.8+ as the fix.

CVE-2017-18515

The wp-statistics plugin before 12.0.8 for WordPress has SQL injection...

WordPress VeronaLabs wp-statistics plugin SQL Injection Vulnerability

WordPress is a blogging platform developed by the WordPress Foundation using the PHP language. The platform supports setting up personal blog sites on PHP and MySQL servers.VeronaLabs wp-statistics plugin is a website statistics plugin used in it. A SQL injection vulnerability exists in the v1/hi...

WordPress WP Statistics Plugin Blind SQL Injection

...

WordPress Plugin WP Statistics Patches XSS Flaw

WordPress plugin WP Statistics has patched a cross-site scripting XSS vulnerability that could allow for full website takeover, if the website is operating under certain non-default settings. WP Statistics gives website owners a tool to analyze site statistics, such as the number of visitors on t...

CVE-2019-13275

An issue was discovered in the VeronaLabs wp-statistics plugin before 12.6.7 for WordPress. The v1/hit endpoint of the API, when the non-default "use cache plugin" setting is enabled, is vulnerable to unauthenticated blind SQL Injection...

Sql injection

An issue was discovered in the VeronaLabs wp-statistics plugin before 12.6.7 for WordPress. The v1/hit endpoint of the API, when the non-default "use cache plugin" setting is enabled, is vulnerable to unauthenticated blind SQL Injection...

CVE-2019-13275

An issue was discovered in the VeronaLabs wp-statistics plugin before 12.6.7 for WordPress. The v1/hit endpoint of the API, when the non-default "use cache plugin" setting is enabled, is vulnerable to unauthenticated blind SQL Injection...

CVE-2019-13275

The CVE-2019-13275 issue affects VeronaLabs wp-statistics plugin for WordPress up to version 12.6.7, where the v1/hit endpoint is vulnerable to unauthenticated blind SQL Injection when the non-default “use cache plugin” setting is enabled. Multiple connected sources (NVD, Red Hat, OSV, CNVD, etc....

WordPress WP Statistics plugin <= 12.6.6.1 - Unauthenticated Stored Cross-Site Scripting (XSS) vulnerability

Unauthenticated Stored Cross-Site Scripting XSS vulnerability found by Antony Garand in WordPress WP Statistics plugin version = 12.6.6.1. The specific configuration needed for exploitation. Solution Update the WordPress WP Statistics plugin to the latest available version at least 12.6.7...

WP Statistics <= 12.6.6.1 - Unauthenticated Blind SQL Injection

An endpoint of the API, which is exposed when the 'use cache plugin' setting is enabled by default disabled, is vulnerable to an unauthenticated blind SQLi issue. time curl -X POST 'http://host/wp-json/wpstatistics/v1/hit' --data...