Wp Statistics
Approved changes feed: RSS · Atom
cpe:2.3:a:veronalabs:wp_statistics:*:*:*:*:*:wordpress:*:*
part: a version: * update: *
| Vendor | Veronalabs (5cbc0319-c96e-5a7f-a4fa-60728b747b85) |
|---|---|
| Product | Wp Statistics (731b0e45-6a4a-5e84-9c30-9a771998dc9d) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | wordpress |
| Target hardware | * |
| Other | * |
| Notes | Imported from purl2cpe mapping |
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
pkg:github/wp-statistics/wp-statistics |
purl2cpe | 2026-06-01 10:11:36.877242 |
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2023-0955 |
vulnerable | 2026-06-08 05:52:33.510606 |
WP Statistics < 14.0 - Authenticated SQLi
The WP Statistics WordPress plugin before 14.0 does not escape a parameter, which could allow authenticated users to perform SQL Injection attacks. By default, the affected feature is available to users with the manage_options capability (admin+), however the plugin has a settings to allow low privilege users to access it as well.
Published: 2023-03-27T15:37:29.971Z
Updated: 2025-02-19T20:04:49.536Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2022-4230 |
vulnerable | 2026-06-08 05:51:37.015055 |
WP Statistics < 13.2.9 - Authenticated SQLi
The WP Statistics WordPress plugin before 13.2.9 does not escape a parameter, which could allow authenticated users to perform SQL Injection attacks. By default, the affected feature is available to users with the manage_options capability (admin+), however the plugin has a settings to allow low privilege users to access it as well.
Published: 2023-01-23T14:31:43.539Z
Updated: 2025-04-02T15:35:05.010Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2022-38074 |
vulnerable | 2026-06-08 05:47:14.538599 |
WordPress WP Statistics Plugin <= 13.2.10 is vulnerable to SQL Injection
CRITICAL (9.9)
SQL Injection vulnerability in VeronaLabs WP Statistics plugin <= 13.2.10 versions.
Published: 2023-03-13T13:43:34.752Z
Updated: 2026-04-28T16:07:46.976Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2022-27231 |
vulnerable | 2026-06-08 05:41:55.051237 |
Details available
Cross-site scripting vulnerability exists in WP Statistics versions prior to 13.2.0 because it improperly processes a platform parameter. By exploiting this vulnerability, an arbitrary script may be executed on the web browser of the user who is logging in to the website using the product.
Published: 2022-06-13T04:50:30.000Z
Updated: 2024-08-03T05:25:32.082Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2022-25307 |
vulnerable | 2026-06-08 05:41:45.695318 |
WP Statistics <= 13.1.5 Unauthenticated Stored Cross-Site Scripting via platform
HIGH (7.2)
The WP Statistics WordPress plugin is vulnerable to Cross-Site Scripting due to insufficient escaping and sanitization of the platform parameter found in the ~/includes/class-wp-statistics-hits.php file which allows attackers to inject arbitrary web scripts onto several pages that execute when site administrators view a sites statistics, in versions up to and including 13.1.5.
Published: 2022-02-24T18:27:12.000Z
Updated: 2025-02-07T20:49:32.081Z Reference links |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2022-25306 |
vulnerable | 2026-06-08 05:41:45.694646 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2022-25305 |
vulnerable | 2026-06-08 05:41:45.694120 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2022-25149 |
vulnerable | 2026-06-08 05:41:45.217051 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2022-25148 |
vulnerable | 2026-06-08 05:41:45.216296 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2022-1005 |
vulnerable | 2026-06-08 05:39:11.647164 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2022-0651 |
vulnerable | 2026-06-08 05:39:10.464597 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2022-0513 |
vulnerable | 2026-06-08 05:39:10.188467 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2021-4333 |
vulnerable | 2026-06-08 05:38:09.201880 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2021-24340 |
vulnerable | 2026-06-08 05:30:04.214877 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2019-13275 |
vulnerable | 2026-06-08 05:12:42.066096 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2019-12566 |
vulnerable | 2026-06-08 05:12:39.329803 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2019-10864 |
vulnerable | 2026-06-08 05:12:25.353379 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2018-1000556 |
vulnerable | 2026-06-08 05:10:25.785246 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2017-18515 |
vulnerable | 2026-06-08 05:09:11.195201 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.