Medium severity · published Jun 13, 2022
CVE-2022-27231
Cross-site scripting vulnerability exists in WP Statistics versions prior to 13.2.0 because it improperly processes a platform parameter
6.1
CVSS
1%
EPSS
No
On KEV
Description
Cross-site scripting vulnerability exists in WP Statistics versions prior to 13.2.0 because it improperly processes a platform parameter. By exploiting this vulnerability, an arbitrary script may be executed on the web browser of the user who is logging in to the website using the product.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
Required
Confidentiality
Low
Integrity
Low
Availability
None
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)1.0% · higher than 64% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
WS
WP Statistics · Veronalabs
before 13.2.0 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2022-27231
CVE.org
https://www.cve.org/CVERecord?id=CVE-2022-27231
Release Notes
https://jvn.jp/en/jp/JVN15241647/index.html
Product
https://wordpress.org/plugins/wp-statistics/
Release Notes
https://wordpress.org/plugins/wp-statistics/#developers
More from WP Statistics
9.8
CVE-2022-25148
The WP Statistics WordPress plugin is vulnerable to SQL Injection due to insufficient escaping and parameterization of the current_page_id parameter found in the…
9.8
CVE-2017-18515
The wp-statistics plugin before 12.0.8 for WordPress has SQL injection
9.8
CVE-2019-13275
An issue was discovered in the VeronaLabs wp-statistics plugin before 12.6.7 for WordPress
8.8
CVE-2023-0955
The WP Statistics WordPress plugin before 14.0 does not escape a parameter, which could allow authenticated users to perform SQL Injection attacks
8.8
CVE-2022-38074
SQL Injection vulnerability in VeronaLabs WP Statistics plugin <= 13.2.10 versions