Extension WordPress
Vulnérabilités WP Statistics – Simple, privacy-friendly Google Analytics alternative, page 2
Cette page rassemble les failles publiées pour WP Statistics – Simple, privacy-friendly Google Analytics alternative, leurs plages de versions affectées et les correctifs signalés dans la base locale.
Historique de sécurité
CVE et vulnérabilités de WP Statistics – Simple, privacy-friendly Google Analytics alternative
38 fiches
WP Statistics <= 13.1.4 – Unauthenticated Blind SQL Injection
The WP Statistics WordPress plugin is vulnerable to SQL Injection due to insufficient escaping and parameterization of the exclusion_reason parameter found in the ~/includes/class-wp-statistics-exclusion.php file which allows attackers without authentication to inject arbitrary SQL queries to obtain sensitive…
*-13.1.4
13.1.5
10/02/2022
WP Statistics <= 13.1.1 – Cross-Site Request Forgery to Arbitrary Plugin Activation and Deactivation
The WP Statistics plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 13.1.1. This is due to missing or incorrect nonce validation on the view() function. This makes it possible for unauthenticated…
*-13.1.1
13.1.2
11/09/2021
WP Statistics <= 13.0.9 – Reflected Cross-Site Scripting
The WP Statistic plugin for WordPress is vulnerable to Reflected Cross-Site Scripting in versions up to, and including, 13.0.9 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web…
*-13.0.9
13.1
30/08/2021
WP Statistics <= 13.0.7 – Unauthenticated SQL Injection
The WP Statistics WordPress plugin before 13.0.8 relied on using the WordPress esc_sql() function on a field not delimited by quotes and did not first prepare the query. Additionally, the page, which should have been accessible to administrator…
[*, 13.0.8)
13.0.8
19/05/2021
WP Statistics <= 12.6.6.1 – Unauthenticated Stored Cross-Site Scripting via IP Manipulation
The WP Statistics plugin for WordPress is vulnerable to Stored Cross-Site Scripting via IP spoofing in versions up to, and including, 12.6.6.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to…
*-12.6.6.1
12.6.7
01/07/2019
WP Statistics <= 12.6.6.1 – Unauthenticated Blind SQL Injection
An issue was discovered in the VeronaLabs wp-statistics plugin before 12.6.7 for WordPress. The v1/hit endpoint of the API, when the non-default "use cache plugin" setting is enabled, is vulnerable to unauthenticated blind SQL Injection.
*-12.6.6.1
12.6.7
01/07/2019
WP Statistics <= 12.6.5 – Stored Cross-Site Scripting
The WP Statistics plugin through 12.6.5 for Wordpress has stored XSS in includes/class-wp-statistics-pages.php. This is related to an account with the Editor role creating a post with a title that contains JavaScript, to attack an admin user.
*-12.6.5
12.6.6.1
31/05/2019
WP Statistics <= 12.6.3 – Referer Cross-Site Scripting
The WP Statistics plugin through 12.6.2 for WordPress has XSS, allowing a remote attacker to inject arbitrary web script or HTML via the Referer header of a GET request.
*-12.6.3
12.6.4
09/04/2019
WP Statistics <= 12.0.9 – Authenticated Cross-Site Scripting
The WP Statistics plugin through 12.0.9 for WordPress has XSS in the rangestart and rangeend parameters on the wps_referrers_page page.
*-12.0.9
12.0.10
07/07/2017
WP Statistics <= 12.0.8.1 – Reflected Cross-Site Scripting
The WP Statistics plugin for WordPress is vulnerable to Reflected Cross-Site Scripting in versions before 12.0.9 due to insufficient input sanitization and output escaping on the IP parameter. This makes it possible for unauthenticated attackers to inject arbitrary…
*-12.0.8.1
12.0.9
03/07/2017
WP Statistics <= 12.0.7 – Authenticated SQL Injection
The wp-statistics plugin before 12.0.8 for WordPress has SQL injection.
*-12.0.7
12.0.8
30/06/2017
WP Statistics <= 12.0.4 – Stored Cross-Site Scripting
Cross-site scripting vulnerability in WP Statistics version 12.0.4 and earlier allows remote attackers to inject arbitrary web script or HTML via specially crafted HTTP Referer headers.
*-12.0.4
12.0.5
13/04/2017
WP Statistics <= 9.5.1 – Cross-Site Scripting
The WP Statistics plugin for WordPress is vulnerable to Cross-Site Scripting in versions up to, and including, 9.5.1 due to insufficient input sanitization and output escaping on the top-referrers page. This makes it possible for attackers to inject…
*-9.5.1
9.5.2
10/08/2015
WP Statistics < 9.4.1 – Authenticated Blind SQL Injection
The WP Statistics plugin for WordPress is vulnerable to blind SQL Injection via the ‘page-id’ parameter in versions before 9.4.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL…
[*, 9.4.1)
9.4.1
09/07/2015
WP Statistics < 9.1.3 – Authenticated (Admin+) Stored Cross-Site Scripting
The WP Statistics plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'Check for online users every:' & 'Coefficient per visitor:' fields in versions before 9.1.3 due to insufficient input sanitization and output escaping. This makes…
[*, 9.1.3)
9.1.3
15/04/2015
WP Statistics <= 8.4 – Stored Cross-Site Scripting
The WP Statistics plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the referer link in versions up to, and including, 8.4 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers…
*-8.4
8.5
03/12/2014
WP Statistics < 8.3.1 – Multiple Cross-Site Scripting
The WP Statistics plugin for WordPress is vulnerable to Multiple Cross-Site Scripting via several parameters in versions before 8.3.1 due to insufficient input sanitization and output escaping. This makes it possible for attackers to inject arbitrary web scripts…
[*, 8.3.1)
8.3.1
20/11/2014
WP Statistics <= 2.2.4 – Cross-Site Scripting
The WP Statistics plugin for WordPress is vulnerable to Cross-Site Scripting in versions up to, and including, 2.2.4 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts…
*-2.2.4
2.2.5
15/05/2012
Extensions également surveillés
WP Commander
Rechercher dans toute la base WordPress
Utilisez la recherche globale pour retrouver une extension, un thème, une CVE ou un identifiant de vulnérabilité.