CVE-2022-0651

The WP Statistics WordPress plugin is vulnerable to SQL Injection due to insufficient escaping and parameterization of the currentpagetype parameter found in the /includes/class-wp-statistics-hits.php file which allows attackers without authentication to inject arbitrary SQL queries to obtain...

CVE-2022-27231

Cross-site scripting vulnerability exists in WP Statistics versions prior to 13.2.0 because it improperly processes a platform parameter. By exploiting this vulnerability, an arbitrary script may be executed on the web browser of the user who is logging in to the website using the product...

EUVD-2019-4160

Malware in sbrugna...

EUVD-2019-2590

Malware in sbrugna...

EUVD-2017-11330

Malware in sbrugna...

EUVD-2017-11318

Malware in sbrugna...

EUVD-2017-11319

Malware in sbrugna...

EUVD-2017-9631

Malware in sbrugna...

EUVD-2017-2629

Malware in sbrugna...

EUVD-2022-29990

Malicious code in bioql PyPI...

EUVD-2022-31740

Malicious code in bioql PyPI...

EUVD-2022-40677

Malicious code in bioql PyPI...

CVE-2025-9816

The WP Statistics – The Most Popular Privacy-Friendly Analytics Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the User-Agent Header in all versions up to, and including, 14.5.4 due to insufficient input sanitization and output escaping. This makes it possible for...

CVE-2025-9816

CVE-2025-9816 : WP Statistics for WordPress is affected by unauthenticated Stored Cross‑Site Scripting via the User‑Agent header in all versions up to 14.5.4. Root cause: insufficient input sanitization and output escaping. Impact: arbitrary script injection executed when users load injected page...

CVE-2025-9816 WP Statistics <= 14.5.4 - Unauthenticated Stored Cross-Site Scripting via User-Agent Header

The WP Statistics – The Most Popular Privacy-Friendly Analytics Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the User-Agent Header in all versions up to, and including, 14.5.4 due to insufficient input sanitization and output escaping. This makes it possible for...

PT-2025-39709

Name of the Vulnerable Software and Affected Versions WP Statistics – The Most Popular Privacy-Friendly Analytics Plugin versions through 14.5.4 Description The software is susceptible to Stored Cross-Site Scripting through the User-Agent Header due to inadequate input sanitization and output...

CVE-2025-55716

CVE-2025-55716 concerns the WordPress plugin WP Statistics (versions up to 14.15). The issue is described as a Missing Authorization vulnerability due to incorrectly configured access control levels, enabling unauthorized actions without user interaction. The CVSS 3.1 base metrics indicate a Netw...

WordPress WP Statistics Plugin <= 14.15 - Broken Access Control Vulnerability

Broken Access Control Vulnerability discovered by Denver Jackson in WordPress Plugin WP Statistics versions = 14.15...

PT-2025-33403 · WordPress · Wp Statistics

Name of the Vulnerable Software and Affected Versions: WP Statistics versions through 14.15 Description: Missing authorization allows exploiting incorrectly configured access control security levels in WP Statistics. Recommendations: At the moment, there is no information about a newer version th...

CVE-2022-4230

The WP Statistics WordPress plugin before 13.2.9 does not escape a parameter, which could allow authenticated users to perform SQL Injection attacks. By default, the affected feature is available to users with the manageoptions capability admin+, however the plugin has a settings to allow low...