Wp Statistics CVE-2022-38074

HIGH

SQL Injection (CWE-89)

2023-03-13 audit@patchstack.com

SQLi Wp Statistics

7.1

CVSS 3.1 · NVD

Share

Severity by source

NVD PRIMARY

7.1 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:L

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:L

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

Low

Lifecycle Timeline

1

CVE Published

Mar 13, 2023 - 14:15 cve.org

HIGH 7.1

DescriptionCVE.org

SQL Injection vulnerability in VeronaLabs WP Statistics plugin <= 13.2.10 versions.

AnalysisAI

SQL Injection vulnerability in VeronaLabs WP Statistics plugin <= 13.2.10 versions. Rated high severity (CVSS 7.1), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.

Technical ContextAI

This vulnerability is classified as SQL Injection (CWE-89), which allows attackers to execute arbitrary SQL commands against the database. SQL Injection vulnerability in VeronaLabs WP Statistics plugin <= 13.2.10 versions. Affected products include: Veronalabs Wp Statistics.

RemediationAI

No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Use parameterized queries/prepared statements. Never concatenate user input into SQL. Apply least-privilege database permissions.

More in Wp Statistics

View all

CVE-2022-25148 CRITICAL Act Now POC

The WP Statistics WordPress plugin is vulnerable to SQL Injection due to insufficient escaping and parameterization of t

CVE-2019-13275 CRITICAL Act Now POC

An issue was discovered in the VeronaLabs wp-statistics plugin before 12.6.7 for WordPress. Rated critical severity (CVS

CVE-2023-0955 HIGH This Week POC

The WP Statistics WordPress plugin before 14.0 does not escape a parameter, which could allow authenticated users to per

CVE-2022-25149 HIGH This Week POC

The WP Statistics WordPress plugin is vulnerable to SQL Injection due to insufficient escaping and parameterization of t

CVE-2022-0651 HIGH This Week POC

The WP Statistics WordPress plugin is vulnerable to SQL Injection due to insufficient escaping and parameterization of t

CVE-2021-24340 HIGH This Week POC

The WP Statistics WordPress plugin before 13.0.8 relied on using the WordPress esc_sql() function on a field not delimit

CVE-2022-1005 MEDIUM This Month POC

The WP Statistics WordPress plugin before 13.2.2 does not sanitise the REQUEST_URI parameter before outputting it back i

CVE-2022-25307 MEDIUM This Month POC

The WP Statistics WordPress plugin is vulnerable to Cross-Site Scripting due to insufficient escaping and sanitization o

CVE-2022-25306 MEDIUM This Month POC

The WP Statistics WordPress plugin is vulnerable to Cross-Site Scripting due to insufficient escaping and sanitization o

CVE-2022-25305 MEDIUM This Month POC

The WP Statistics WordPress plugin is vulnerable to Cross-Site Scripting due to insufficient escaping and sanitization o

CVE-2018-1000556 MEDIUM This Month POC

WordPress version 4.8 + contains a Cross Site Scripting (XSS) vulnerability in plugins.php or core wordpress on delete f

CVE-2019-12566 MEDIUM This Month POC

The WP Statistics plugin through 12.6.5 for Wordpress has stored XSS in includes/class-wp-statistics-pages.php. Rated me

Same weakness CWE-89 – SQL Injection

View all

CVE-2023-48788 CRITICAL POC

CVE-2025-57819 CRITICAL POC

CVE-2017-8917 CRITICAL POC

CVE-2024-27956 CRITICAL POC

CVE-2014-3704 HIGH POC

CVE-2016-2555 CRITICAL POC

CVE-2016-8582 CRITICAL POC

CVE-2015-7297 HIGH POC

Same technique SQLi

View all

CVE-2025-57819 CRITICAL POC

CVE-2017-8917 CRITICAL POC

CVE-2024-27956 CRITICAL POC

CVE-2014-3704 HIGH POC

CVE-2016-2555 CRITICAL POC

CVE-2016-8582 CRITICAL POC

CVE-2013-0333 HIGH POC

CVE-2015-7297 HIGH POC

Share

CVE-2022-38074 vulnerability details – vuln.today

Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy