GCVE - cpe:2.3:a:unknown:wp_statistics:*:*:*:*:*:*:*:*

Approved changes feed: RSS · Atom

cpe:2.3:a:unknown:wp_statistics:*:*:*:*:*:*:*:*

part: a version: * update: *

Vendor	Unknown (`668ca391-a6cc-5e33-879b-83885214de33`)
Product	Wp Statistics (`1ab59f44-507f-52c3-b095-bd9d638aeb25`)
Edition	*
Language	*
Software edition	*
Target software	*
Target hardware	*
Other	*
Notes	Imported from gcve-enriched-dumps CVE data

PURL mappings

PURL	Source	Last updated
No PURL mappings for this CPE yet.

Vulnerability references

Identifier	cpeApplicability	Submitted	db.gcve.eu details	Rationale
`CVE:CVE-2023-0955`	vulnerable	2026-06-08 05:52:33.509146	WP Statistics < 14.0 - Authenticated SQLi The WP Statistics WordPress plugin before 14.0 does not escape a parameter, which could allow authenticated users to perform SQL Injection attacks. By default, the affected feature is available to users with the manage_options capability (admin+), however the plugin has a settings to allow low privilege users to access it as well. Published: 2023-03-27T15:37:29.971Z Updated: 2025-02-19T20:04:49.536Z Open on db.gcve.eu Reference links https://wpscan.com/vulnerability/18b7e93f-b038-4f28-918b-4015d62f0eb8	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2022-4230`	vulnerable	2026-06-08 05:51:37.014271	WP Statistics < 13.2.9 - Authenticated SQLi The WP Statistics WordPress plugin before 13.2.9 does not escape a parameter, which could allow authenticated users to perform SQL Injection attacks. By default, the affected feature is available to users with the manage_options capability (admin+), however the plugin has a settings to allow low privilege users to access it as well. Published: 2023-01-23T14:31:43.539Z Updated: 2025-04-02T15:35:05.010Z Open on db.gcve.eu Reference links https://wpscan.com/vulnerability/a0e40cfd-b217-481c-8fc4-027a0a023312	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2022-1005`	vulnerable	2026-06-08 05:39:11.647105	WP Statistics < 13.2.2 - Reflected Cross-Site Scripting The WP Statistics WordPress plugin before 13.2.2 does not sanitise the REQUEST_URI parameter before outputting it back in the rendered page, leading to Cross-Site Scripting (XSS) in web browsers which do not encode characters Published: 2022-06-06T08:50:53.000Z Updated: 2024-08-02T23:47:42.970Z Open on db.gcve.eu Reference links https://wpscan.com/vulnerability/f37d1d55-10cc-4202-8d16-9ec2128f54f9	Imported from gcve-enriched-dumps CVE data

Contribute

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.