Lucene search
WpvulndbWPVDB-ID:A5A90DBC-64FD-4278-A098-8C278D0BF00EHistoryFeb 16, 2022 - 12:00 a.m.
WP Statistics < 13.1.6 - Unauthenticated Blind SQL Injection via current_page_id
2022-02-1600:00:00
wpscan.com
16
0.508 Medium
EPSS
Percentile
97.5%
The plugin is vulnerable to SQL Injection due to insufficient escaping and parameterization of the current_page_id parameter found in the ~/includes/class-wp-statistics-hits.php file which allows attackers without authentication to inject arbitrary SQL queries to obtain sensitive information.
| CPE | Name | Operator | Version |
|---|---|---|---|
| wp-statistics | lt | 13.1.6 |
Related
nuclei
nuclei
WordPress Plugin WP Statistics <= 13.1.5 - SQL Injection
2023-10-17 07:20:28
cve
cve
CVE-2022-25148
2022-02-24 19:15:10
patchstack
patchstack
nvd
nvd
CVE-2022-25148
2022-02-24 19:15:10
prion
prion
Sql injection
2022-02-24 19:15:00
cvelist
cvelist
checkpoint_advisories
checkpoint_advisories
WordPress WP Statistics Plugin SQL Injection (CVE-2022-25148)
2022-03-13 00:00:00
packetstorm
packetstorm
WordPress WP Statistics 13.1.5 SQL Injection
2023-09-05 00:00:00
zdt
zdt
exploitdb
exploitdb
openvas
openvas
WordPress WP Statistics Plugin < 13.1.6 Multiple Vulnerabilities
2022-03-08 00:00:00