Vulnerabilities > Veronalabs

DATE CVE VULNERABILITY TITLE RISK
2022-06-08 CVE-2022-1005 Cross-site Scripting vulnerability in Veronalabs WP Statistics
The WP Statistics WordPress plugin before 13.2.2 does not sanitise the REQUEST_URI parameter before outputting it back in the rendered page, leading to Cross-Site Scripting (XSS) in web browsers which do not encode characters
network
low complexity
veronalabs CWE-79
6.1
2022-02-24 CVE-2022-0651 SQL Injection vulnerability in Veronalabs WP Statistics
The WP Statistics WordPress plugin is vulnerable to SQL Injection due to insufficient escaping and parameterization of the current_page_type parameter found in the ~/includes/class-wp-statistics-hits.php file which allows attackers without authentication to inject arbitrary SQL queries to obtain sensitive information, in versions up to and including 13.1.5.
network
low complexity
veronalabs CWE-89
7.5
2022-02-24 CVE-2022-25148 SQL Injection vulnerability in Veronalabs WP Statistics
The WP Statistics WordPress plugin is vulnerable to SQL Injection due to insufficient escaping and parameterization of the current_page_id parameter found in the ~/includes/class-wp-statistics-hits.php file which allows attackers without authentication to inject arbitrary SQL queries to obtain sensitive information, in versions up to and including 13.1.5.
network
low complexity
veronalabs CWE-89
critical
9.8
2022-02-24 CVE-2022-25149 SQL Injection vulnerability in Veronalabs WP Statistics
The WP Statistics WordPress plugin is vulnerable to SQL Injection due to insufficient escaping and parameterization of the IP parameter found in the ~/includes/class-wp-statistics-hits.php file which allows attackers without authentication to inject arbitrary SQL queries to obtain sensitive information, in versions up to and including 13.1.5.
network
low complexity
veronalabs CWE-89
7.5
2022-02-24 CVE-2022-25305 Cross-site Scripting vulnerability in Veronalabs WP Statistics
The WP Statistics WordPress plugin is vulnerable to Cross-Site Scripting due to insufficient escaping and sanitization of the IP parameter found in the ~/includes/class-wp-statistics-ip.php file which allows attackers to inject arbitrary web scripts onto several pages that execute when site administrators view a sites statistics, in versions up to and including 13.1.5.
network
low complexity
veronalabs CWE-79
6.1
2022-02-24 CVE-2022-25306 Cross-site Scripting vulnerability in Veronalabs WP Statistics
The WP Statistics WordPress plugin is vulnerable to Cross-Site Scripting due to insufficient escaping and sanitization of the browser parameter found in the ~/includes/class-wp-statistics-visitor.php file which allows attackers to inject arbitrary web scripts onto several pages that execute when site administrators view a sites statistics, in versions up to and including 13.1.5.
network
low complexity
veronalabs CWE-79
6.1
2022-02-24 CVE-2022-25307 Cross-site Scripting vulnerability in Veronalabs WP Statistics
The WP Statistics WordPress plugin is vulnerable to Cross-Site Scripting due to insufficient escaping and sanitization of the platform parameter found in the ~/includes/class-wp-statistics-hits.php file which allows attackers to inject arbitrary web scripts onto several pages that execute when site administrators view a sites statistics, in versions up to and including 13.1.5.
network
low complexity
veronalabs CWE-79
6.1
2022-02-16 CVE-2022-0513 SQL Injection vulnerability in Veronalabs WP Statistics
The WP Statistics WordPress plugin is vulnerable to SQL Injection due to insufficient escaping and parameterization of the exclusion_reason parameter found in the ~/includes/class-wp-statistics-exclusion.php file which allows attackers without authentication to inject arbitrary SQL queries to obtain sensitive information, in versions up to and including 13.1.4.
network
low complexity
veronalabs CWE-89
7.5
2021-08-23 CVE-2021-24561 Cross-site Scripting vulnerability in Veronalabs WP SMS
The WP SMS WordPress plugin before 5.4.13 does not sanitise the "wp_group_name" parameter before outputting it back in the "Groups" page, leading to an Authenticated Stored Cross-Site Scripting issue
network
low complexity
veronalabs CWE-79
5.4
2021-06-07 CVE-2021-24340 SQL Injection vulnerability in Veronalabs WP Statistics
The WP Statistics WordPress plugin before 13.0.8 relied on using the WordPress esc_sql() function on a field not delimited by quotes and did not first prepare the query.
network
low complexity
veronalabs CWE-89
7.5