Lucene search
K
Database
Vendors
Products
Years
CVSS
Scanner
Agent Scanning
API Scanning
Manual Audit
Perimeter Scanner
Scanning
Projects
Email
Webhook
Plugins
Resources
Documents
Blog
Glossary
FAQ
Pricing
Contacts
About Us
Partners
Branding Guideline
wpvulndbWpvulndbWPVDB-ID:FC822698-1F5A-4371-8C6E-2CA250C3C26D
HistoryFeb 17, 2022 - 12:00 a.m.

WP Statistics < 13.1.6 - Multiple Unauthenticated Stored Cross-Site Scripting

2022-02-1700:00:00
wpscan.com
19

0.002 Low

EPSS

Percentile

52.7%

JSON

The plugin is vulnerable to Cross-Site Scripting due to insufficient escaping and sanitization of the IP, browser and platform parameter found in the ~/includes/class-wp-statistics-hits.php file which allows attackers to inject arbitrary web scripts onto several pages that execute when site administrators view a sites statistics

CPENameOperatorVersion
wp-statisticslt13.1.6

Related

openvas 1
patchstack 3
nvd 3
prion 3
cve 3
cvelist 3
cnvd 1
checkpoint_advisories 1
openvas
openvas
WordPress WP Statistics Plugin < 13.1.6 Multiple Vulnerabilities
2022-03-08 00:00:00
patchstack
patchstack
WordPress WP Statistics plugin <= 13.1.5 - Unauthenticated Stored Cross-Site Scripting (XSS) vulnerability
2022-02-17 00:00:00
WordPress WP Statistics plugin <= 13.1.5 - Unauthenticated Stored Cross-Site Scripting (XSS) vulnerability
2022-02-17 00:00:00
WordPress WP Statistics plugin <= 13.1.5 - Unauthenticated Stored Cross-Site Scripting (XSS) vulnerability
2022-02-17 00:00:00
nvd
nvd
CVE-2022-25306
2022-02-24 19:15:10
CVE-2022-25305
2022-02-24 19:15:10
CVE-2022-25307
2022-02-24 19:15:10
prion
prion
Cross site scripting
2022-02-24 19:15:00
Cross site scripting
2022-02-24 19:15:00
Cross site scripting
2022-02-24 19:15:00
cve
cve
CVE-2022-25307
2022-02-24 19:15:10
CVE-2022-25305
2022-02-24 19:15:10
CVE-2022-25306
2022-02-24 19:15:10
cvelist
cvelist
CVE-2022-25307 WP Statistics <= 13.1.5 Unauthenticated Stored Cross-Site Scripting via platform
2022-02-24 18:27:12
CVE-2022-25305 WP Statistics <= 13.1.5 Unauthenticated Stored Cross-Site Scripting via IP
2022-02-24 18:27:11
CVE-2022-25306 WP Statistics <= 13.1.5 Unauthenticated Stored Cross-Site Scripting via browser
2022-02-24 18:27:09
cnvd
cnvd
WordPress and WordPress plugin cross-site scripting vulnerability
2022-02-25 00:00:00
checkpoint_advisories
checkpoint_advisories
Cross-Site Scripting Scanning Attempt (CVE-2015-4661; CVE-2019-16385; CVE-2019-9167; CVE-2020-10946; CVE-2020-12261; CVE-2020-13228; CVE-2020-13627; CVE-2020-13628; CVE-2020-14953; CVE-2021-21801; CVE-2021-25080; CVE-2022-25305; CVE-2022-28102)
2016-03-22 00:00:00

0.002 Low

EPSS

Percentile

52.7%

JSON
Related for WPVDB-ID:FC822698-1F5A-4371-8C6E-2CA250C3C26D
openvas1patchstack3nvd3prion3cve3cvelist3cnvd1checkpoint_advisories1