Updated 6 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,764exploited flaws on CISA’s list

35added in the last 30 days

456new WordPress flaws this week

390,714entries in the database

235 results · page 3 of 5

Mar 17, 2024WP Visitor Statistics (Real Time Traffic): Exposure of Sensitive Information to an Unauthorized ActorCVE-2024-24867 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Osamaesh WP Visitor Statistics (Real Time Traffic).This issue affects WP Visitor Statistics (Real Time Traffic): from n/a through 6.9.4.
Product
WP Visitor Statistics (Real Time Traffic)
Affected
up to 6.9.4
What to do
Affects up to 6.9.4. Update WP Visitor Statistics (Real Time Traffic) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Mar 13, 2024WP Statistics: Stored Cross-Site ScriptingCVE-2024-2194 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The WP Statistics plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the URL search parameter in all versions up to, and including, 14.5 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
WP Statistics
Affected
up to 14.5
What to do
Affects up to 14.5. Update WP Statistics to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Mar 13, 2024Burst Statistics – Privacy-Friendly Analytics for: Stored Cross-Site ScriptingCVE-2024-1894 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Burst Statistics – Privacy-Friendly Analytics for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'burst_total_pageviews_count' custom meta field in all versions up to, and including, 1.5.6.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Note that this exploit only functions if the victim has the 'Show Toolbar when viewing site' option enabled in their profile.
Product
Burst Statistics – Privacy-Friendly Analytics for
Affected
up to 1.5.6.1
What to do
Affects up to 1.5.6.1. Update Burst Statistics – Privacy-Friendly Analytics for to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Mar 8, 2024IBM SPSS Statistics 26.0, 27.0.1, and 28.0 IO Module could allow a local user to create multiple files that could exhaust the file handles capacity and cause a CVE-2022-43855 · Other software · IBM · reported by psirt@us.ibm.comMedium 6.2
IBM SPSS Statistics 26.0, 27.0.1, and 28.0 IO Module could allow a local user to create multiple files that could exhaust the file handles capacity and cause a denial of service.
Product
SPSS Statistics
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record ibm.com exchange.xforce.ibmcloud.com
Jan 17, 2024The Burst Statistics – Privacy-Friendly Analytics for WordPress plugin, version 1.5.3, is vulnerable to Post-Authenticated SQL Injection via multiple JSON paramCVE-2024-0405 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The Burst Statistics – Privacy-Friendly Analytics for WordPress plugin, version 1.5.3, is vulnerable to Post-Authenticated SQL Injection via multiple JSON parameters in the /wp-json/burst/v1/data/compare endpoint. Affected parameters include 'browser', 'device', 'page_id', 'page_url', 'platform', and 'referrer'. This vulnerability arises due to insufficient escaping of user-supplied parameters and the lack of adequate preparation in SQL queries. As a result, authenticated attackers with editor access or higher can append additional SQL queries into existing ones, potentially leading to unauthorized access to sensitive information from the database.
Fixed in
1.5.3
What to do
Update the plugin to 1.5.3 or newer.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jan 11, 2024Nginx-UI is an online statistics for Server Indicators Monitor CPU usage, memory usage, load average, and disk usage in real-time.CVE-2024-22196 · Other software · 0xJacky · reported by GitHubHigh 7
Nginx-UI is an online statistics for Server Indicators Monitor CPU usage, memory usage, load average, and disk usage in real-time. This issue may lead to information disclosure. By using `DefaultQuery`, the `"desc"` and `"id"` values are used as default values if the query parameters are not set. Thus, the `order` and `sort_by` query parameter are user-controlled and are being appended to the `order` variable without any sanitization. This issue has been patched in version 2.0.0.beta.9.
Product
nginx-ui
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Jan 11, 2024Nginx-ui is online statistics for Server Indicators Monitor CPU usage, memory usage, load average, and disk usage in real-time.CVE-2024-22197 · Other software · 0xJacky · reported by GitHubHigh 7.7
Nginx-ui is online statistics for Server Indicators Monitor CPU usage, memory usage, load average, and disk usage in real-time. The `Home > Preference` page exposes a small list of nginx settings such as `Nginx Access Log Path` and `Nginx Error Log Path`. However, the API also exposes `test_config_cmd`, `reload_cmd` and `restart_cmd`. While the UI doesn't allow users to modify any of these settings, it is possible to do so by sending a request to the API. This issue may lead to authenticated Remote Code Execution, Privilege Escalation, and Information Disclosure. This issue has been patched in version 2.0.0.beta.9.
Product
nginx-ui
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Dec 6, 2023Burst Statistics – Privacy-Friendly Analytics for: SQL InjectionCVE-2023-5761 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The Burst Statistics – Privacy-Friendly Analytics for WordPress plugin for WordPress is vulnerable to SQL Injection via the 'url' parameter in versions 1.4.0 to 1.4.6.1 (free) and versions 1.4.0 to 1.5.0 (pro) due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
Product
Burst Statistics – Privacy-Friendly Analytics for
Affected
1.4.0 to 1.4.6.1
What to do
Affects 1.4.0 to 1.4.6.1. Update Burst Statistics – Privacy-Friendly Analytics for to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Oct 16, 2023Cross-Site Request Forgery (CSRF) vulnerability in Christopher Finke Feed Statistics plugin <= 4.1 versions.CVE-2023-45605 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in Christopher Finke Feed Statistics plugin <= 4.1 versions.
Affected
up to 4.1
What to do
Affects up to 4.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Oct 3, 2023QSige statistics are affected by a remote SQLi vulnerability.CVE-2023-4103 · Other software · IDM Sistemas QSige · reported by cve-coordination@incibe.esHigh 8.8
QSige statistics are affected by a remote SQLi vulnerability. It has been identified that the web application does not correctly filter input parameters, allowing SQL injections, DoS or information disclosure. As a prerequisite, it is necessary to log into the application.
Product
QSige
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record incibe.es incibe.es
Aug 22, 2023A buffer overflow can occur when calculating the quantile value using the Statistics Library of GSL (GNU Scientific Library), versions 2.5 and 2.6.CVE-2020-35357 · Other software · GNU · reported by MITREMedium 6.5
A buffer overflow can occur when calculating the quantile value using the Statistics Library of GSL (GNU Scientific Library), versions 2.5 and 2.6. Processing a maliciously crafted input data for gsl_stats_quantile_from_sorted_data of the library may lead to unexpected application termination or arbitrary code execution.
Product
GNU Scientific Library
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record git.savannah.gnu.org lists.debian.org
Jul 6, 2023TravianZ through 8.3.4 allows XSS via the Alliance tag/name, the statistics page, the link preferences, the Admin Logs, or the COOKUSR cookie.CVE-2023-36995 · Other software · Travianz Project · reported by MITREMedium 6.1
TravianZ through 8.3.4 allows XSS via the Alliance tag/name, the statistics page, the link preferences, the Admin Logs, or the COOKUSR cookie.
Product
Travianz
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record bramdoessecurity.com bramdoessecurity.com
May 16, 2023A missing permission check in Jenkins Tag Profiler Plugin 0.2 and earlier allows attackers with Overall/Read permission to reset profiler statistics.CVE-2023-33004 · Websites & servers · Jenkins Project · reported by jenkinsci-cert@googlegroups.comMedium 4.3
A missing permission check in Jenkins Tag Profiler Plugin 0.2 and earlier allows attackers with Overall/Read permission to reset profiler statistics.
Product
Jenkins Tag Profiler Plugin
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record jenkins.io jenkins.io
May 16, 2023A cross-site request forgery (CSRF) vulnerability in Jenkins Tag Profiler Plugin 0.2 and earlier allows attackers to reset profiler statistics.CVE-2023-33003 · Websites & servers · Jenkins Project · reported by jenkinsci-cert@googlegroups.comMedium 4.3
A cross-site request forgery (CSRF) vulnerability in Jenkins Tag Profiler Plugin 0.2 and earlier allows attackers to reset profiler statistics.
Product
Jenkins Tag Profiler Plugin
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record jenkins.io jenkins.io
May 15, 2023WP Visitor Statistics (Real Time Traffic): Does not escape user inputCVE-2023-0600 · WordPress plugins & themes · reported by WPScanCritical 9.8
The WP Visitor Statistics (Real Time Traffic) WordPress plugin before 6.9 does not escape user input which is concatenated to an SQL query, allowing unauthenticated visitors to conduct SQL Injection attacks.
Product
WP Visitor Statistics (Real Time Traffic)
Fixed in
6.9
What to do
Update WP Visitor Statistics (Real Time Traffic) to 6.9 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Apr 26, 2023The Splus Server component of TIBCO Software Inc.'s TIBCO Spotfire Statistics Services contains a vulnerability that allows an unauthenticated remote attacker tCVE-2023-29268 · Other software · TIBCO Software Inc. · reported by security@tibco.comCritical 9.8
The Splus Server component of TIBCO Software Inc.'s TIBCO Spotfire Statistics Services contains a vulnerability that allows an unauthenticated remote attacker to upload or modify arbitrary files within the web server directory on the affected system. Affected releases are TIBCO Software Inc.'s TIBCO Spotfire Statistics Services: versions 11.4.10 and below, versions 11.5.0, 11.6.0, 11.6.1, 11.6.2, 11.7.0, 11.8.0, 11.8.1, 12.0.0, 12.0.1, and 12.0.2, versions 12.1.0 and 12.2.0.
Product
TIBCO Spotfire Statistics Services
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record tibco.com tibco.com
Mar 27, 2023WP Statistics: Does not escape a parameterCVE-2023-0955 · WordPress plugins & themes · reported by WPScanHigh 8.8
The WP Statistics WordPress plugin before 14.0 does not escape a parameter, which could allow authenticated users to perform SQL Injection attacks. By default, the affected feature is available to users with the manage_options capability (admin+), however the plugin has a settings to allow low privilege users to access it as well.
Product
WP Statistics
Fixed in
14.0
What to do
Update WP Statistics to 14.0 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Mar 13, 2023SQL Injection vulnerability in VeronaLabs WP Statistics plugin <= 13.2.10 versions.CVE-2022-38074 · WordPress plugins & themes · reported by PatchstackHigh 7.1
SQL Injection vulnerability in VeronaLabs WP Statistics plugin <= 13.2.10 versions.
Affected
up to 13.2.10
What to do
Affects up to 13.2.10. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Mar 7, 2023WP Statistics: Cross-Site Request ForgeryCVE-2021-4333 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The WP Statistics plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 13.1.1. This is due to missing or incorrect nonce validation on the view() function. This makes it possible for unauthenticated attackers to activate and deactivate arbitrary plugins, via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Product
WP Statistics
Affected
up to 13.1.1
What to do
Affects up to 13.1.1. Update WP Statistics to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Feb 13, 2023WP Visitor Statistics (Real Time Traffic): Does not validate and escape one of its shortcode attributesCVE-2022-4656 · WordPress plugins & themes · reported by WPScanMedium 5.4
The WP Visitor Statistics (Real Time Traffic) WordPress plugin before 6.5 does not validate and escape one of its shortcode attributes, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attack.
Product
WP Visitor Statistics (Real Time Traffic)
Fixed in
6.5
What to do
Update WP Visitor Statistics (Real Time Traffic) to 6.5 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Jan 23, 2023WP Statistics: Does not escape a parameterCVE-2022-4230 · WordPress plugins & themes · reported by WPScanHigh 8.8
The WP Statistics WordPress plugin before 13.2.9 does not escape a parameter, which could allow authenticated users to perform SQL Injection attacks. By default, the affected feature is available to users with the manage_options capability (admin+), however the plugin has a settings to allow low privilege users to access it as well.
Product
WP Statistics
Fixed in
13.2.9
What to do
Update WP Statistics to 13.2.9 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Nov 22, 2022An authenticated SQL Injection vulnerability in the statistics page (/statistics/retrieve) of Maarch RM 2.8, via the filter parameter, allows the complete disclCVE-2022-37773 · Other software · Maarch · reported by MITREMedium 6.5
An authenticated SQL Injection vulnerability in the statistics page (/statistics/retrieve) of Maarch RM 2.8, via the filter parameter, allows the complete disclosure of all databases.
Product
Maarch RM
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Nov 15, 2022A missing permission check in Jenkins Cluster Statistics Plugin 0.4.6 and earlier allows attackers to delete recorded Jenkins Cluster Statistics.CVE-2022-45399 · Websites & servers · Jenkins project · reported by jenkinsci-cert@googlegroups.comMedium 4.3
A missing permission check in Jenkins Cluster Statistics Plugin 0.4.6 and earlier allows attackers to delete recorded Jenkins Cluster Statistics.
Product
Jenkins Cluster Statistics Plugin
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record openwall.com jenkins.io
Nov 15, 2022A cross-site request forgery (CSRF) vulnerability in Jenkins Cluster Statistics Plugin 0.4.6 and earlier allows attackers to delete recorded Jenkins Cluster StaCVE-2022-45398 · Websites & servers · Jenkins project · reported by jenkinsci-cert@googlegroups.comMedium 4.3
A cross-site request forgery (CSRF) vulnerability in Jenkins Cluster Statistics Plugin 0.4.6 and earlier allows attackers to delete recorded Jenkins Cluster Statistics.
Product
Jenkins Cluster Statistics Plugin
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record openwall.com jenkins.io
Jul 25, 2022Multiple Unauthenticated SQL Injection (SQLi) vulnerabilities in Osamaesh WP Visitor Statistics plugin <= 5.7 at WordPress.CVE-2022-33965 · WordPress plugins & themes · reported by PatchstackCritical 9.3
Multiple Unauthenticated SQL Injection (SQLi) vulnerabilities in Osamaesh WP Visitor Statistics plugin <= 5.7 at WordPress.
Affected
up to 5.7
What to do
Affects up to 5.7. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com wordpress.org
Jun 27, 2022A vulnerability was found in Analytics Stats Counter Statistics Plugin 1.2.2.5 and classified as critical.CVE-2017-20099 · Other software · unspecified · reported by VulDBHigh 7.3
A vulnerability was found in Analytics Stats Counter Statistics Plugin 1.2.2.5 and classified as critical. This issue affects some unknown processing. The manipulation leads to code injection. The attack may be initiated remotely.
Product
Analytics Stats Counter Statistics Plugin
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record seclists.org vuldb.com
Jun 13, 2022Cross-site scripting vulnerability exists in WP Statistics versions prior to 13.2.0 because it improperly processes a platform parameter.CVE-2022-27231 · WordPress plugins & themes · reported by vultures@jpcert.or.jpMedium 6.1
Cross-site scripting vulnerability exists in WP Statistics versions prior to 13.2.0 because it improperly processes a platform parameter. By exploiting this vulnerability, an arbitrary script may be executed on the web browser of the user who is logging in to the website using the product.
Fixed in
13.2.0
What to do
Update the plugin to 13.2.0 or newer.
Full record and what to do →NVD record jvn.jp wordpress.org
Jun 8, 2022WP Statistics: Does not sanitise the REQUEST_URI parameter before outputting it back in the rendered pageCVE-2022-1005 · WordPress plugins & themes · reported by WPScanMedium 6.1
The WP Statistics WordPress plugin before 13.2.2 does not sanitise the REQUEST_URI parameter before outputting it back in the rendered page, leading to Cross-Site Scripting (XSS) in web browsers which do not encode characters
Product
WP Statistics
Fixed in
13.2.2
What to do
Update WP Statistics to 13.2.2 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Mar 7, 2022WP Visitor Statistics (Real Time Traffic): Does not sanitise and escape the id parameter before using it in a SQL statement via the refUrlDetails AJAX actionCVE-2022-0410 · WordPress plugins & themes · reported by WPScanHigh 8.8
The WP Visitor Statistics (Real Time Traffic) WordPress plugin before 5.6 does not sanitise and escape the id parameter before using it in a SQL statement via the refUrlDetails AJAX action, available to any authenticated user, leading to a SQL injection
Product
WP Visitor Statistics (Real Time Traffic)
Fixed in
5.6
What to do
Update WP Visitor Statistics (Real Time Traffic) to 5.6 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Feb 28, 2022WP Visitor Statistics (Real Time Traffic): Does not have authorisation and CSRF checks in the updateIpAddress AJAX actionCVE-2021-25042 · WordPress plugins & themes · reported by WPScanMedium 5.4
The WP Visitor Statistics (Real Time Traffic) WordPress plugin before 5.5 does not have authorisation and CSRF checks in the updateIpAddress AJAX action, allowing any authenticated user to call it, or make a logged in user do it via a CSRF attack and add an arbitrary IP address to exclude. Furthermore, due to the lack of validation, sanitisation and escaping, users could set a malicious value and perform Cross-Site Scripting attacks against logged in admin
Product
WP Visitor Statistics (Real Time Traffic)
Fixed in
5.5
What to do
Update WP Visitor Statistics (Real Time Traffic) to 5.5 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Feb 24, 2022WP Statistics: Cross-Site ScriptingCVE-2022-25307 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The WP Statistics WordPress plugin is vulnerable to Cross-Site Scripting due to insufficient escaping and sanitization of the platform parameter found in the ~/includes/class-wp-statistics-hits.php file which allows attackers to inject arbitrary web scripts onto several pages that execute when site administrators view a sites statistics, in versions up to and including 13.1.5.
Product
WP Statistics
Affected
up to 13.1.5
What to do
Affects up to 13.1.5. Update WP Statistics to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record gist.github.com plugins.trac.wordpress.org
Feb 24, 2022WP Statistics: Cross-Site ScriptingCVE-2022-25306 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The WP Statistics WordPress plugin is vulnerable to Cross-Site Scripting due to insufficient escaping and sanitization of the browser parameter found in the ~/includes/class-wp-statistics-visitor.php file which allows attackers to inject arbitrary web scripts onto several pages that execute when site administrators view a sites statistics, in versions up to and including 13.1.5.
Product
WP Statistics
Affected
up to 13.1.5
What to do
Affects up to 13.1.5. Update WP Statistics to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record gist.github.com plugins.trac.wordpress.org
Feb 24, 2022WP Statistics: Cross-Site ScriptingCVE-2022-25305 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The WP Statistics WordPress plugin is vulnerable to Cross-Site Scripting due to insufficient escaping and sanitization of the IP parameter found in the ~/includes/class-wp-statistics-ip.php file which allows attackers to inject arbitrary web scripts onto several pages that execute when site administrators view a sites statistics, in versions up to and including 13.1.5.
Product
WP Statistics
Affected
up to 13.1.5
What to do
Affects up to 13.1.5. Update WP Statistics to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record gist.github.com plugins.trac.wordpress.org
Feb 24, 2022WP Statistics: SQL InjectionCVE-2022-25149 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The WP Statistics WordPress plugin is vulnerable to SQL Injection due to insufficient escaping and parameterization of the IP parameter found in the ~/includes/class-wp-statistics-hits.php file which allows attackers without authentication to inject arbitrary SQL queries to obtain sensitive information, in versions up to and including 13.1.5.
Product
WP Statistics
Affected
up to 13.1.5
What to do
Affects up to 13.1.5. Update WP Statistics to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record gist.github.com plugins.trac.wordpress.org
Feb 24, 2022WP Statistics: SQL InjectionCVE-2022-25148 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The WP Statistics WordPress plugin is vulnerable to SQL Injection due to insufficient escaping and parameterization of the current_page_id parameter found in the ~/includes/class-wp-statistics-hits.php file which allows attackers without authentication to inject arbitrary SQL queries to obtain sensitive information, in versions up to and including 13.1.5.
Product
WP Statistics
Affected
up to 13.1.5
What to do
Affects up to 13.1.5. Update WP Statistics to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record packetstormsecurity.com gist.github.com
Feb 24, 2022WP Statistics: SQL InjectionCVE-2022-0651 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The WP Statistics WordPress plugin is vulnerable to SQL Injection due to insufficient escaping and parameterization of the current_page_type parameter found in the ~/includes/class-wp-statistics-hits.php file which allows attackers without authentication to inject arbitrary SQL queries to obtain sensitive information, in versions up to and including 13.1.5.
Product
WP Statistics
Affected
up to 13.1.5
What to do
Affects up to 13.1.5. Update WP Statistics to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record gist.github.com plugins.trac.wordpress.org
Feb 16, 2022WP Statistics: SQL InjectionCVE-2022-0513 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The WP Statistics WordPress plugin is vulnerable to SQL Injection due to insufficient escaping and parameterization of the exclusion_reason parameter found in the ~/includes/class-wp-statistics-exclusion.php file which allows attackers without authentication to inject arbitrary SQL queries to obtain sensitive information, in versions up to and including 13.1.4. This requires the "Record Exclusions" option to be enabled on the vulnerable site.
Product
WP Statistics
Affected
up to 13.1.4
What to do
Affects up to 13.1.4. Update WP Statistics to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Feb 1, 2022Perfect Survey: Does not sanitise and escape multiple parameters (id and filters[session_id] of single_statistics pageCVE-2021-24764 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Perfect Survey WordPress plugin before 1.5.2 does not sanitise and escape multiple parameters (id and filters[session_id] of single_statistics page, type and message of importexport page) before outputting them back in pages/attributes in the admin dashboard, leading to Reflected Cross-Site Scripting issues
Product
Perfect Survey
Fixed in
1.5.2
What to do
Update Perfect Survey to 1.5.2 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Jan 24, 2022Newsletter, SMTP, Email marketing and Subscribe forms by Sendinblue: Does not escape the sib-statistics-date parameter before outputting it back in an attributeCVE-2021-24923 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Newsletter, SMTP, Email marketing and Subscribe forms by Sendinblue WordPress plugin before 3.1.25 does not escape the sib-statistics-date parameter before outputting it back in an attribute, leading to a Reflected Cross-Site Scripting issue
Product
Newsletter, SMTP, Email marketing and Subscribe forms by Sendinblue
Fixed in
3.1.25
What to do
Update Newsletter, SMTP, Email marketing and Subscribe forms by Sendinblue to 3.1.25 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Dec 21, 2021WP Visitor Statistics (Real Time Traffic): Does not properly sanitise and escape the refUrl in the refDetails AJAX actionCVE-2021-24750 · WordPress plugins & themes · reported by WPScanHigh 8.8
The WP Visitor Statistics (Real Time Traffic) WordPress plugin before 4.8 does not properly sanitise and escape the refUrl in the refDetails AJAX action, available to any authenticated user, which could allow users with a role as low as subscriber to perform SQL injection attacks
Product
WP Visitor Statistics (Real Time Traffic)
Fixed in
4.8
What to do
Update WP Visitor Statistics (Real Time Traffic) to 4.8 or newer.
Full record and what to do →NVD record packetstormsecurity.com plugins.trac.wordpress.org
Nov 17, 2021IBM SPSS Statistics for Windows 24.0, 25.0, 26.0, 27.0, 27.0.1, and 28.0 could allow a local user to cause a denial of service by writing arbitrary files to admCVE-2021-38959 · Other software · IBM · reported by psirt@us.ibm.comMedium 5.5
IBM SPSS Statistics for Windows 24.0, 25.0, 26.0, 27.0, 27.0.1, and 28.0 could allow a local user to cause a denial of service by writing arbitrary files to admin protected directories on the system. IBM X-Force ID: 212046.
Product
SPSS Statistics
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record exchange.xforce.ibmcloud.com ibm.com
Nov 12, 2021Possible memory corruption due to improper validation of memory address while processing user-space IOCTL for clearing Filter and Route statistics in SnapdragonCVE-2021-30265 · Computers, phones & browsers · Qualcomm, Inc. · reported by product-security@qualcomm.comMedium 6.7
Possible memory corruption due to improper validation of memory address while processing user-space IOCTL for clearing Filter and Route statistics in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables
Product
Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, S
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record qualcomm.com qualcomm.com
Nov 8, 2021Visitor Traffic Real Time Statistics: Does not validate and escape user input passed to the today_traffic_index AJAX action (available to any authenticated users) before using it in a SQL statementCVE-2021-24829 · WordPress plugins & themes · reported by WPScanHigh 8.8
The Visitor Traffic Real Time Statistics WordPress plugin before 3.9 does not validate and escape user input passed to the today_traffic_index AJAX action (available to any authenticated users) before using it in a SQL statement, leading to an SQL injection issue
Product
Visitor Traffic Real Time Statistics
Fixed in
3.9
What to do
Update Visitor Traffic Real Time Statistics to 3.9 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Oct 26, 2021Pi-hole's Web interface (based on AdminLTE) provides a central location to manage one's Pi-hole and review the statistics generated by FTLDNS.CVE-2021-41175 · Other software · pi-hole · reported by GitHubHigh 7.3
Pi-hole's Web interface (based on AdminLTE) provides a central location to manage one's Pi-hole and review the statistics generated by FTLDNS. Prior to version 5.8, cross-site scripting is possible when adding a client via the groups-clients management page. This issue was patched in version 5.8.
Product
AdminLTE
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Aug 4, 2021Pi-hole's Web interface provides a central location to manage a Pi-hole instance and review performance statistics.CVE-2021-32793 · Other software · pi-hole · reported by GitHubMedium 5.7
Pi-hole's Web interface provides a central location to manage a Pi-hole instance and review performance statistics. Prior to Pi-hole Web interface version 5.5.1, the function to add domains to blocklists or allowlists is vulnerable to a stored cross-site-scripting vulnerability. User input added as a wildcard domain to a blocklist or allowlist is unfiltered in the web interface. Since the payload is stored permanently as a wildcard domain, this is a persistent XSS vulnerability. A remote attacker can therefore attack administrative user accounts through client-side attacks. Pi-hole Web Interface version 5.5.1 contains a patch for this vulnerability.
Product
AdminLTE
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Aug 4, 2021Pi-hole's Web interface provides a central location to manage a Pi-hole instance and review performance statistics.CVE-2021-32706 · Other software · pi-hole · reported by GitHubHigh 7.6
Pi-hole's Web interface provides a central location to manage a Pi-hole instance and review performance statistics. Prior to Pi-hole Web interface version 5.5.1, the `validDomainWildcard` preg_match filter allows a malicious character through that can be used to execute code, list directories, and overwrite sensitive files. The issue lies in the fact that one of the periods is not escaped, allowing any character to be used in its place. A patch for this vulnerability was released in version 5.5.1.
Product
AdminLTE
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Jun 7, 2021WP Statistics: Relied on using the WordPress esc_sql() function on a field not delimited by quotes and did not first prepare the queryCVE-2021-24340 · WordPress plugins & themes · reported by WPScanHigh 7.5
The WP Statistics WordPress plugin before 13.0.8 relied on using the WordPress esc_sql() function on a field not delimited by quotes and did not first prepare the query. Additionally, the page, which should have been accessible to administrator only, was also available to any visitor, including unauthenticated ones.
Product
WP Statistics
Fixed in
13.0.8
What to do
Update WP Statistics to 13.0.8 or newer.
Full record and what to do →NVD record wpscan.com wordfence.com
May 14, 2021Low privileged users can use the AJAX action 'cp_plugins_do_button_job_later_callback' in the Visitor Traffic Real Time Statistics WordPress plugin before 2.12,CVE-2021-24193 · WordPress plugins & themes · reported by WPScanHigh 8.8
Low privileged users can use the AJAX action 'cp_plugins_do_button_job_later_callback' in the Visitor Traffic Real Time Statistics WordPress plugin before 2.12, to install any plugin (including a specific version) from the WordPress repository, as well as activate arbitrary plugin from then blog, which helps attackers install vulnerable plugins and could lead to more critical vulnerabilities like RCE.
Product
Visitor Traffic Real Time Statistics
Fixed in
2.12
What to do
Update Visitor Traffic Real Time Statistics to 2.12 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Mar 30, 2021Jenkins Cloud Statistics Plugin 0.26 and earlier does not perform a permission check in an HTTP endpoint, allowing attackers with Overall/Read permission and knCVE-2021-21631 · Websites & servers · Jenkins project · reported by jenkinsci-cert@googlegroups.comMedium 4.3
Jenkins Cloud Statistics Plugin 0.26 and earlier does not perform a permission check in an HTTP endpoint, allowing attackers with Overall/Read permission and knowledge of random activity IDs to view related provisioning exception error messages.
Product
Jenkins Cloud Statistics Plugin
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record openwall.com jenkins.io
Nov 18, 2020An issue was discovered in the view_statistics (aka View frontend statistics) extension before 2.0.1 for TYPO3.CVE-2020-28917 · Other software · View Frontend Statistics Project · reported by MITREMedium 6.5
An issue was discovered in the view_statistics (aka View frontend statistics) extension before 2.0.1 for TYPO3. It saves all GET and POST data of TYPO3 frontend requests to the database. Depending on the extensions used on a TYPO3 website, sensitive data (e.g., cleartext passwords if ext:felogin is installed) may be saved.
Product
View Frontend Statistics
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record typo3.org typo3.org

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.