CVE Database /
CVE-2022-25306
CVE · Medium
CVE-2022-25306 — WP Statistics – Simple, privacy-friendly Google Analytics alternative [wp-statistics] < 13.1.6
| CVE |
Vulnerability |
Type |
Severity |
Affected |
Fixed in |
Published |
Status |
|
CVE-2022-25306
|
WP Statistics – Simple, privacy-friendly Google Analytics alternative [wp-statistics] < 13.1.6 |
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') |
Medium
6.1
|
< 13.1.6
|
13.1.6 |
2022-02-16 |
—
|
CVE-2022-25306
The WP Statistics plugin through version 13.1.5 contains a cross-site scripting vulnerability in the browser parameter within the visitor tracking functionality. An attacker can inject malicious scripts by exploiting inadequate input sanitization and output escaping in the affected code. When administrators access the statistics pages to review site data, the injected scripts execute in their browsers. This flaw was remedied in version 13.1.6.
Based on public CVE data (MITRE/NVD).
Scan your WordPress site free
No signup, no credit card — enter your URL and get a security report in seconds.
See the full security page for this plugin
Browse the CVE database
Browse all security findings