Wp Stats
Monthly
Stored cross-site scripting in the WP-Stats WordPress plugin (all versions up to and including 2.56) allows unauthenticated remote attackers to inject persistent JavaScript payloads into WordPress pages due to insufficient input sanitization and output escaping. Every subsequent visitor to an injected page - including site administrators - will involuntarily execute the attacker's script in their browser, enabling session hijacking, credential theft, or unauthorized administrative actions. No public exploit code has been identified at time of analysis, and this CVE does not appear in the CISA Known Exploited Vulnerabilities catalog.
Unauthenticated reflected XSS in the WP-Stats WordPress plugin (versions 2.56 and below) enables remote attackers to inject arbitrary JavaScript into victim browsers without requiring any authentication to the target site. Because the CVSS vector carries a scope change (S:C), a successful attack can escape the plugin's security boundary and execute within the administrator's browser session, enabling session hijacking, credential harvesting, or backdoor injection into the WordPress installation. No public exploit code or CISA KEV listing has been identified at time of analysis, but the zero-privilege attack vector and low complexity make this straightforward to weaponize via a phishing link once a suitable victim is identified.
Stored cross-site scripting in the WP-Stats WordPress plugin (all versions up to and including 2.56) allows unauthenticated remote attackers to inject persistent JavaScript payloads into WordPress pages due to insufficient input sanitization and output escaping. Every subsequent visitor to an injected page - including site administrators - will involuntarily execute the attacker's script in their browser, enabling session hijacking, credential theft, or unauthorized administrative actions. No public exploit code has been identified at time of analysis, and this CVE does not appear in the CISA Known Exploited Vulnerabilities catalog.
Unauthenticated reflected XSS in the WP-Stats WordPress plugin (versions 2.56 and below) enables remote attackers to inject arbitrary JavaScript into victim browsers without requiring any authentication to the target site. Because the CVSS vector carries a scope change (S:C), a successful attack can escape the plugin's security boundary and execute within the administrator's browser session, enabling session hijacking, credential harvesting, or backdoor injection into the WordPress installation. No public exploit code or CISA KEV listing has been identified at time of analysis, but the zero-privilege attack vector and low complexity make this straightforward to weaponize via a phishing link once a suitable victim is identified.