Vulnerability · Published Feb 24, 2022 · Assigned by Wordfence

CVE-2022-25307WP Statistics <= 13.1.5 Unauthenticated Stored Cross-Site Scripting via platform

High 7.2

In plain English

A high-severity cross-site scripting in WP Statistics from WP Statistics. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.4% (higher than 72% of all known vulnerabilities).

Severity (CVSS 3.1)7.2High

Exploit odds (30 days)1.4%top 27.8% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

The WP Statistics WordPress plugin is vulnerable to Cross-Site Scripting due to insufficient escaping and sanitization of the platform parameter found in the ~/includes/class-wp-statistics-hits.php file which allows attackers to inject arbitrary web scripts onto several pages that execute when site administrators view a sites statistics, in versions up to and including 13.1.5.

Affected products (as reported)

Vendor	Product	Versions
WP Statistics	WP Statistics	13.1.5 – through 13.1.5

Weakness: CWE-79 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N

References

https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=2679983%40wp-statistics&new=2679983%40wp-statistics&sfp_email=&sfph_mail= x_refsource_MISC
https://gist.github.com/Xib3rR4dAr/8090a6d026d4601083cff80aa80de7eb x_refsource_MISC
https://www.wordfence.com/vulnerability-advisories/#CVE-2022-25307 x_refsource_MISC