CVE Database /
CVE-2022-25148
CVE · Critical
CVE-2022-25148 — WP Statistics – Simple, privacy-friendly Google Analytics alternative [wp-statistics] < 13.1.6
| CVE |
Vulnerability |
Type |
Severity |
Affected |
Fixed in |
Published |
Status |
|
CVE-2022-25148
|
WP Statistics – Simple, privacy-friendly Google Analytics alternative [wp-statistics] < 13.1.6 |
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') |
Critical
9.8
|
< 13.1.6
|
13.1.6 |
2022-02-16 |
—
|
CVE-2022-25148
The WP Statistics plugin through version 13.1.5 contains a SQL injection vulnerability in the current_page_id parameter within its hits tracking functionality. An unauthenticated attacker can exploit insufficient input escaping and parameterization to execute arbitrary SQL queries and access sensitive data. The vulnerability was fixed in version 13.1.6.
Based on public CVE data (MITRE/NVD).
Scan your WordPress site free
No signup, no credit card — enter your URL and get a security report in seconds.
See the full security page for this plugin
Browse the CVE database
Browse all security findings