Wp Statistics Simple Privacy Friendly Google Analytics Alternative
Monthly
Stored cross-site scripting in WP Statistics (all versions through 14.16.8) allows unauthenticated remote attackers to permanently inject arbitrary JavaScript into a WordPress site's database and have it execute in any privileged user's browser session when viewing the plugin's statistics dashboards. The vulnerability chain is precise: the REST API signature required to submit a hit request is exposed on the public homepage, and a base64-encoded page_uri POST parameter to the /wp-statistics/v2/hit endpoint overrides the previously sanitized REQUEST_URI, smuggling an unsanitized utm_campaign value into the database. No public exploit code or CISA KEV listing has been identified at time of analysis, though the low exploitation complexity and large WordPress install base elevate practical urgency significantly.
Stored Cross-Site Scripting in WP Statistics plugin (≤14.16.4) allows unauthenticated attackers to inject malicious JavaScript into admin dashboard analytics pages. The vulnerability stems from unsafe handling of utm_source URL parameters that persist into database-backed charts, executing when administrators view Referrals Overview or Social Media pages. With CVSS 7.2 and network vector requiring no authentication, this represents elevated risk for WordPress sites using this analytics plugin, though no active exploitation confirmed at time of analysis.
Reflected cross-site scripting in the WordPress plugin WP Statistics (VeronaLabs) affects all versions up to and including 14.16.14, allowing an unauthenticated attacker to inject arbitrary script through the query-parameter key of the request URI, which the plugin reflects into admin-side pages without adequate sanitization or output escaping. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N, 6.1) confirms no attacker privileges are needed but that exploitation is gated by user interaction - the victim, realistically a logged-in administrator viewing an affected WP Statistics admin view such as the Referrals page, must be tricked into clicking an attacker-crafted link, so impact is per-victim and social-engineering dependent rather than a passive compromise. The issue is patched in version 14.16.15; no public exploit code or confirmed active exploitation was identified at time of analysis.
WP Statistics plugin for WordPress versions up to 14.16.4 fail to enforce capability checks on multiple AJAX endpoints, allowing authenticated Subscriber-level users to access sensitive analytics data, retrieve and modify privacy audit status, and dismiss administrative notices. The vulnerability stems from reliance on nonce verification alone without role-based access control, affecting all installations with the plugin active and at least one authenticated user account. No public exploit code or active exploitation has been confirmed at time of analysis.
Stored cross-site scripting in WP Statistics (all versions through 14.16.8) allows unauthenticated remote attackers to permanently inject arbitrary JavaScript into a WordPress site's database and have it execute in any privileged user's browser session when viewing the plugin's statistics dashboards. The vulnerability chain is precise: the REST API signature required to submit a hit request is exposed on the public homepage, and a base64-encoded page_uri POST parameter to the /wp-statistics/v2/hit endpoint overrides the previously sanitized REQUEST_URI, smuggling an unsanitized utm_campaign value into the database. No public exploit code or CISA KEV listing has been identified at time of analysis, though the low exploitation complexity and large WordPress install base elevate practical urgency significantly.
Stored Cross-Site Scripting in WP Statistics plugin (≤14.16.4) allows unauthenticated attackers to inject malicious JavaScript into admin dashboard analytics pages. The vulnerability stems from unsafe handling of utm_source URL parameters that persist into database-backed charts, executing when administrators view Referrals Overview or Social Media pages. With CVSS 7.2 and network vector requiring no authentication, this represents elevated risk for WordPress sites using this analytics plugin, though no active exploitation confirmed at time of analysis.
Reflected cross-site scripting in the WordPress plugin WP Statistics (VeronaLabs) affects all versions up to and including 14.16.14, allowing an unauthenticated attacker to inject arbitrary script through the query-parameter key of the request URI, which the plugin reflects into admin-side pages without adequate sanitization or output escaping. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N, 6.1) confirms no attacker privileges are needed but that exploitation is gated by user interaction - the victim, realistically a logged-in administrator viewing an affected WP Statistics admin view such as the Referrals page, must be tricked into clicking an attacker-crafted link, so impact is per-victim and social-engineering dependent rather than a passive compromise. The issue is patched in version 14.16.15; no public exploit code or confirmed active exploitation was identified at time of analysis.
WP Statistics plugin for WordPress versions up to 14.16.4 fail to enforce capability checks on multiple AJAX endpoints, allowing authenticated Subscriber-level users to access sensitive analytics data, retrieve and modify privacy audit status, and dismiss administrative notices. The vulnerability stems from reliance on nonce verification alone without role-based access control, affecting all installations with the plugin active and at least one authenticated user account. No public exploit code or active exploitation has been confirmed at time of analysis.