CVE-2017-10991

The WP Statistics plugin through 12.0.9 for WordPress has XSS in the rangestart and rangeend parameters on the wpsreferrerspage page...

CVE-2017-10991

CVE-2017-10991 affects the WordPress WP Statistics plugin up to version 12.0.9. The vulnerability is an XSS in the rangestart and rangeend parameters on the wps_referrers_page. CVSS metrics in the provided documents indicate: confidentiality impact LOW, integrity impact PARTIAL, availability impa...

WP Statistics <= 12.0.9 - Authenticated Cross-Site Scripting (XSS)

The WP Statistics WordPress plugin was affected by an Authenticated Cross-Site Scripting XSS security vulnerability. PoC http://mywordpress.com/wp-admin/admin.php?page=wpsreferrerspage=123123"...

WP Statistics SQL Injection vulnerability

Security experts at Sucuri have discovered a SQL Injection vulnerability in WP Statistics, one of the most popular WordPress plugins, that is currently installed on over 300,000 websites. The SQL Injection vulnerability in WP Statistics could be exploited by attackers, with at least a subscriber...

WordPress WP Statistics plugin <=12.0.7 - Authenticated SQL Injection vulnerability

WordPress WP Statistic plugin in version 12.0.7 and earlier versions vulnerable to Authenticated SQL Injection vulnerability due to lack of sanitization in user-provided data. In this case users even with subscriber rights could use this vulnerability to steal sensitive data. Solution The plugin...

WordPress Plugin Used by 300,000+ Sites Found Vulnerable to SQL Injection Attack

A SQL Injection vulnerability has been discovered in one of the most popular Wordpress plugins, installed on over 300,000 websites, which could be exploited by hackers to steal databases and possibly hijack the affected sites remotely. The flaw has been discovered in the highly popular WP...

WP Statistics <= 12.0.7 - Authenticated SQL Injection

The WP Statistics WordPress plugin was affected by an Authenticated SQL Injection security vulnerability...

CVE-2017-2147

Cross-site scripting vulnerability in WP Statistics version 12.0.4 and earlier allows remote attackers to inject arbitrary web script or HTML via unspecified vectors...

CVE-2017-2135

Cross-site scripting vulnerability in WP Statistics version 12.0.1 and earlier allows remote attackers to inject arbitrary web script or HTML via unspecified vectors...

CVE-2017-2136

Cross-site scripting vulnerability in WP Statistics version 12.0.4 and earlier allows remote attackers to inject arbitrary web script or HTML via specially crafted HTTP Referer headers...

CVE-2017-2147

Cross-site scripting vulnerability in WP Statistics version 12.0.4 and earlier allows remote attackers to inject arbitrary web script or HTML via unspecified vectors...

CVE-2017-2136

Cross-site scripting vulnerability in WP Statistics version 12.0.4 and earlier allows remote attackers to inject arbitrary web script or HTML via specially crafted HTTP Referer headers...

Cross site scripting

Cross-site scripting vulnerability in WP Statistics version 12.0.1 and earlier allows remote attackers to inject arbitrary web script or HTML via unspecified vectors...

Cross site scripting

Cross-site scripting vulnerability in WP Statistics version 12.0.4 and earlier allows remote attackers to inject arbitrary web script or HTML via unspecified vectors...

CVE-2017-2147

Cross-site scripting vulnerability in WP Statistics version 12.0.4 and earlier allows remote attackers to inject arbitrary web script or HTML via unspecified vectors...

CVE-2017-2135

The WP Statistics WordPress plugin is affected by a reflected cross-site scripting vulnerability (CWE-79) reported for version 12.0.1 and earlier. Multiple connected advisories confirm XSS vectors that can execute script in a logged-in user’s browser, with exploit details not fully disclosed in a...

CVE-2017-2136

Cross-site scripting vulnerability in WP Statistics version 12.0.4 and earlier allows remote attackers to inject arbitrary web script or HTML via specially crafted HTTP Referer headers...

CVE-2017-2135

Cross-site scripting vulnerability in WP Statistics version 12.0.1 and earlier allows remote attackers to inject arbitrary web script or HTML via unspecified vectors...

CVE-2017-2147

WP Statistics for WordPress is affected in versions 12.0.4 and earlier by a stored cross-site scripting vulnerability (CWE-79). An attacker can inject arbitrary script via unspecified vectors, impacting users’ browsers. Remediation: update the WP Statistics plugin to version 12.0.5 or later, as i...

CVE-2017-2136

CVE-2017-2136 (WP Statistics) affects the WordPress WP Statistics plugin, version 12.0.4 and earlier. The root cause is a cross-site scripting flaw triggered by specially crafted HTTP Referer headers, allowing an attacker to inject arbitrary script or HTML in users’ browsers. Affected products an...