Vulnerability · Published Feb 24, 2022 · Assigned by Wordfence

CVE-2022-25306WP Statistics <= 13.1.5 Unauthenticated Stored Cross-Site Scripting via browser

High 7.2

In plain English

A high-severity cross-site scripting in WP Statistics from WP Statistics. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.4% (higher than 72% of all known vulnerabilities).

Severity (CVSS 3.1)7.2High

Exploit odds (30 days)1.4%top 27.8% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

The WP Statistics WordPress plugin is vulnerable to Cross-Site Scripting due to insufficient escaping and sanitization of the browser parameter found in the ~/includes/class-wp-statistics-visitor.php file which allows attackers to inject arbitrary web scripts onto several pages that execute when site administrators view a sites statistics, in versions up to and including 13.1.5.

Affected products (as reported)

Vendor	Product	Versions
WP Statistics	WP Statistics	13.1.5 – through 13.1.5

Weakness: CWE-79 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N

References

https://gist.github.com/Xib3rR4dAr/89fc87ea1d62348c21c99fc11a3bfd88 x_refsource_MISC
https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=2679983%40wp-statistics&new=2679983%40wp-statistics&sfp_email=&sfph_mail= x_refsource_MISC
https://www.wordfence.com/vulnerability-advisories/#CVE-2022-25306 x_refsource_MISC