Vulnerabilities > Veronalabs > WP Statistics

DATE CVE VULNERABILITY TITLE RISK
2023-03-27 CVE-2023-0955 Unspecified vulnerability in Veronalabs WP Statistics
The WP Statistics WordPress plugin before 14.0 does not escape a parameter, which could allow authenticated users to perform SQL Injection attacks.
network
low complexity
veronalabs
8.8
2023-03-13 CVE-2022-38074 SQL Injection vulnerability in Veronalabs WP Statistics
SQL Injection vulnerability in VeronaLabs WP Statistics plugin <= 13.2.10 versions.
network
low complexity
veronalabs CWE-89
8.8
2023-03-07 CVE-2021-4333 Unspecified vulnerability in Veronalabs WP Statistics
The WP Statistics plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 13.1.1.
network
low complexity
veronalabs
6.5
2023-01-23 CVE-2022-4230 SQL Injection vulnerability in Veronalabs WP Statistics
The WP Statistics WordPress plugin before 13.2.9 does not escape a parameter, which could allow authenticated users to perform SQL Injection attacks.
network
low complexity
veronalabs CWE-89
8.8
2022-06-13 CVE-2022-27231 Cross-site Scripting vulnerability in Veronalabs WP Statistics
Cross-site scripting vulnerability exists in WP Statistics versions prior to 13.2.0 because it improperly processes a platform parameter.
network
veronalabs CWE-79
4.3
2022-06-08 CVE-2022-1005 Cross-site Scripting vulnerability in Veronalabs WP Statistics
The WP Statistics WordPress plugin before 13.2.2 does not sanitise the REQUEST_URI parameter before outputting it back in the rendered page, leading to Cross-Site Scripting (XSS) in web browsers which do not encode characters
network
veronalabs CWE-79
4.3
2022-02-24 CVE-2022-0651 SQL Injection vulnerability in Veronalabs WP Statistics
The WP Statistics WordPress plugin is vulnerable to SQL Injection due to insufficient escaping and parameterization of the current_page_type parameter found in the ~/includes/class-wp-statistics-hits.php file which allows attackers without authentication to inject arbitrary SQL queries to obtain sensitive information, in versions up to and including 13.1.5.
network
low complexity
veronalabs CWE-89
5.0
2022-02-24 CVE-2022-25148 SQL Injection vulnerability in Veronalabs WP Statistics
The WP Statistics WordPress plugin is vulnerable to SQL Injection due to insufficient escaping and parameterization of the current_page_id parameter found in the ~/includes/class-wp-statistics-hits.php file which allows attackers without authentication to inject arbitrary SQL queries to obtain sensitive information, in versions up to and including 13.1.5.
network
low complexity
veronalabs CWE-89
critical
9.8
2022-02-24 CVE-2022-25149 SQL Injection vulnerability in Veronalabs WP Statistics
The WP Statistics WordPress plugin is vulnerable to SQL Injection due to insufficient escaping and parameterization of the IP parameter found in the ~/includes/class-wp-statistics-hits.php file which allows attackers without authentication to inject arbitrary SQL queries to obtain sensitive information, in versions up to and including 13.1.5.
network
low complexity
veronalabs CWE-89
5.0
2022-02-24 CVE-2022-25305 Cross-site Scripting vulnerability in Veronalabs WP Statistics
The WP Statistics WordPress plugin is vulnerable to Cross-Site Scripting due to insufficient escaping and sanitization of the IP parameter found in the ~/includes/class-wp-statistics-ip.php file which allows attackers to inject arbitrary web scripts onto several pages that execute when site administrators view a sites statistics, in versions up to and including 13.1.5.
network
veronalabs CWE-79
4.3