WS
Product
WP Statistics
24
CVEs
0
On KEV
9.8
Max CVSS
2
New 30D
Severity mix
Critical 3High 10Medium 11Low 0
Watch
Add WP Statistics to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2021-4333 | 6.5 | Mar 7 | The WP Statistics plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 13.1.1 Affected: through 13.1.1 |
| CVE-2026-84774 | 6.1 | Sep 3 | WordPress WP Statistics plugin <= 14.16.11 - Cross Site Scripting (XSS) vulnerability Affected: through 14.16.11 |
| CVE-2022-27231 | 6.1 | Jun 13 | Cross-site scripting vulnerability exists in WP Statistics versions prior to 13.2.0 because it improperly processes a platform parameter Affected: before 13.2.0 |
| CVE-2022-1005 | 6.1 | Jun 8 | The WP Statistics WordPress plugin before 13.2.2 does not sanitise the REQUEST_URI parameter before outputting it back in the rendered page, leading to Cross-Site Scripting (XSS)… Affected: before 13.2.2 |
| CVE-2022-25307 | 6.1 | Feb 24 | The WP Statistics WordPress plugin is vulnerable to Cross-Site Scripting due to insufficient escaping and sanitization of the platform parameter found in the… Affected: through 13.1.5 |
| CVE-2022-25306 | 6.1 | Feb 24 | The WP Statistics WordPress plugin is vulnerable to Cross-Site Scripting due to insufficient escaping and sanitization of the browser parameter found in the… Affected: through 13.1.5 |
| CVE-2022-25305 | 6.1 | Feb 24 | The WP Statistics WordPress plugin is vulnerable to Cross-Site Scripting due to insufficient escaping and sanitization of the IP parameter found in the… Affected: through 13.1.5 |
| CVE-2019-10864 | 6.1 | Apr 23 | The WP Statistics plugin through 12.6.2 for WordPress has XSS, allowing a remote attacker to inject arbitrary web script or HTML via the Referer header of a GET request Affected: through 12.6.2 |
| CVE-2018-1000556 | 6.1 | Jun 26 | WordPress version 4.8 + contains a Cross Site Scripting (XSS) vulnerability in plugins.php or core wordpress on delete function that can result in An attacker can perform client… Affected: before 12.0.6 |
| CVE-2019-12566 | 5.4 | Jun 3 | The WP Statistics plugin through 12.6.5 for Wordpress has stored XSS in includes/class-wp-statistics-pages.php Affected: through 12.6.5 |
| CVE-2025-55716 | 4.3 | Aug 14 | WordPress WP Statistics Plugin <= 14.15 - Broken Access Control Vulnerability Affected: through 14.15 |
Showing 11