CVE Database /
CVE-2022-4230
CVE · High
CVE-2022-4230 — WP Statistics – Simple, privacy-friendly Google Analytics alternative [wp-statistics] < 13.2.9
| CVE |
Vulnerability |
Type |
Severity |
Affected |
Fixed in |
Published |
Status |
|
CVE-2022-4230
|
WP Statistics – Simple, privacy-friendly Google Analytics alternative [wp-statistics] < 13.2.9 |
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') |
High
8.8
|
< 13.2.9
|
13.2.9 |
2022-12-27 |
—
|
CVE-2022-4230
The WP Statistics plugin through version 13.2.8 contains a SQL injection vulnerability in the $search_engine parameter that allows administrators to execute unauthorized database queries. The flaw stems from inadequate escaping of user input and improper query preparation, enabling attackers with admin access to append malicious SQL commands and access sensitive database contents. This vulnerability was remedied in version 13.2.9.
Based on public CVE data (MITRE/NVD).
Scan your WordPress site free
No signup, no credit card — enter your URL and get a security report in seconds.
See the full security page for this plugin
Browse the CVE database
Browse all security findings