PatchTheCVEwp statistics vulnerabilities and fixes
Recent CVEs affecting wp statistics, with upgrade or downgrade steps. 23 tracked.
Also searched as: wpstatistics.
wp statistics has 23 tracked vulnerabilities, 6 critical. A fixed release or vendor patch exists for 23. Most recent: 2023-03-27. Highest priority: CVE-2022-25149 (score 72/100).
- CVE-2023-0955 HIGH 8.8 UPGRADE The WP Statistics WordPress plugin before 14.0 does not escape a parameter, which could allow authenticated us
- CVE-2022-4230 HIGH 8.8 UPGRADE The WP Statistics WordPress plugin before 13.2.9 does not escape a parameter, which could allow authenticated
- CVE-2022-38074 HIGH 7.1 UPGRADE SQL Injection vulnerability in VeronaLabs WP Statistics plugin <= 13.2.10 versions.
- CVE-2022-27231 MEDIUM 6.1 UPGRADE Cross-site scripting vulnerability exists in WP Statistics versions prior to 13.2.0 because it improperly proc
- CVE-2022-25307 HIGH 7.2 UPGRADE The WP Statistics WordPress plugin is vulnerable to Cross-Site Scripting due to insufficient escaping and sani
- CVE-2022-25306 HIGH 7.2 UPGRADE The WP Statistics WordPress plugin is vulnerable to Cross-Site Scripting due to insufficient escaping and sani
- CVE-2022-25305 HIGH 7.2 UPGRADE The WP Statistics WordPress plugin is vulnerable to Cross-Site Scripting due to insufficient escaping and sani
- CVE-2022-25149 CRITICAL 9.8 UPGRADE The WP Statistics WordPress plugin is vulnerable to SQL Injection due to insufficient escaping and parameteriz
- CVE-2022-25148 CRITICAL 9.8 UPGRADE The WP Statistics WordPress plugin is vulnerable to SQL Injection due to insufficient escaping and parameteriz
- CVE-2022-1005 MEDIUM 6.1 UPGRADE The WP Statistics WordPress plugin before 13.2.2 does not sanitise the REQUEST_URI parameter before outputting
- CVE-2022-0651 CRITICAL 9.8 UPGRADE The WP Statistics WordPress plugin is vulnerable to SQL Injection due to insufficient escaping and parameteriz
- CVE-2022-0513 CRITICAL 9.8 UPGRADE The WP Statistics WordPress plugin is vulnerable to SQL Injection due to insufficient escaping and parameteriz
- CVE-2021-4333 MEDIUM 6.5 UPGRADE The WP Statistics plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and incl
- CVE-2021-24340 HIGH 7.5 UPGRADE The WP Statistics WordPress plugin before 13.0.8 relied on using the WordPress esc_sql() function on a field n
- CVE-2019-13275 CRITICAL 9.8 UPGRADE An issue was discovered in the VeronaLabs wp-statistics plugin before 12.6.7 for WordPress
- CVE-2019-12566 MEDIUM 5.4 UPGRADE The WP Statistics plugin through 12.6.5 for Wordpress has stored XSS in includes/class-wp-statistics-pages.php
- CVE-2019-10864 MEDIUM 6.1 UPGRADE The WP Statistics plugin through 12.6.2 for WordPress has XSS, allowing a remote attacker to inject arbitrary
- CVE-2018-1000556 MEDIUM 6.1 UPGRADE WordPress version 4.8 + contains a Cross Site Scripting (XSS) vulnerability in plugins.php or core wordpress o
- CVE-2017-2147 MEDIUM 6.1 UPGRADE Cross-site scripting vulnerability in WP Statistics version 12.0.4 and earlier allows remote attackers to inje
- CVE-2017-2136 MEDIUM 6.1 UPGRADE Cross-site scripting vulnerability in WP Statistics version 12.0.4 and earlier allows remote attackers to inje
- CVE-2017-2135 MEDIUM 6.1 UPGRADE Cross-site scripting vulnerability in WP Statistics version 12.0.1 and earlier allows remote attackers to inje
- CVE-2017-18515 CRITICAL 9.8 UPGRADE The wp-statistics plugin before 12.0.8 for WordPress has SQL injection.
- CVE-2017-10991 MEDIUM 6.1 UPGRADE The WP Statistics plugin through 12.0.9 for WordPress has XSS in the rangestart and rangeend parameters on the
FAQ
How do I fix wp statistics vulnerabilities?
Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.
Is wp statistics being exploited right now?
None of the tracked wp statistics CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.
Which wp statistics CVE should I patch first?
CVE-2022-25149 currently ranks highest (72/100): The WP Statistics WordPress plugin is vulnerable to SQL Injection due to insufficient escaping and parameteriz.