Vulnerability · Published Feb 24, 2022 · Assigned by Wordfence

CVE-2022-25305WP Statistics <= 13.1.5 Unauthenticated Stored Cross-Site Scripting via IP

High 7.2

In plain English

A high-severity cross-site scripting in WP Statistics from WP Statistics. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 78.9% (higher than 99.6% of all known vulnerabilities).

Severity (CVSS 3.1)7.2High

Exploit odds (30 days)78.9%top 0.4% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

The WP Statistics WordPress plugin is vulnerable to Cross-Site Scripting due to insufficient escaping and sanitization of the IP parameter found in the ~/includes/class-wp-statistics-ip.php file which allows attackers to inject arbitrary web scripts onto several pages that execute when site administrators view a sites statistics, in versions up to and including 13.1.5.

Affected products (as reported)

Vendor	Product	Versions
WP Statistics	WP Statistics	13.1.5 – through 13.1.5

Weakness: CWE-79 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N

References

https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=2679983%40wp-statistics&new=2679983%40wp-statistics&sfp_email=&sfph_mail= x_refsource_MISC
https://gist.github.com/Xib3rR4dAr/af90cef7867583ab2de4cccea2a8c87d x_refsource_MISC
https://www.wordfence.com/vulnerability-advisories/#CVE-2022-25305 x_refsource_MISC