WordPress CVEs

Description

The WP-Stats WordPress plugin before 2.52 does not have CSRF check when saving its settings, and did not escape some of them when outputting them, allowing attacker to make logged in high privilege users change them and set Cross-Site Scripting payloads

Affected WordPress components

• WP-Stats Plugin · wp-stats
  Confirmed match Active
  From 2.52 (including) to 2.52 (excluding); Before 2.52
  View on WordPress.org

A confirmed match is backed by the plugin or theme slug. A possible match is based on the product name only and should be verified.

Affected products and versions

• Unknown WP-Stats — From 2.52 (including) to 2.52 (excluding)
• wp-stats_project wp-stats — Before 2.52

References

• wpscan.com https://wpscan.com/vulnerability/f5c3dfea-7203-4a98-88ff-aa6a24d03734 Third Party Advisory
• www.openwall.com https://www.openwall.com/lists/oss-security/2015/06/17/6 Exploit, Mailing List, Third Party Advisory
• nvd.nist.gov Official NVD record