Skip to content
Noroxi

VeronaLabs records

29 published records for vendor veronalabs.

Researcher profile

Entered KEV
0 · 0%
Weaponized
0 · 0%
Pre-auth RCE
1
With a fix record
27.6%
Median publish → KEV
No record has entered KEV

Records by year

  1. 18
  2. 19
  3. 21
  4. 22
  5. 23
  6. 24

Bar: total · dark part: CISA KEV.

Recurring classes

The weakness classes this vendor ships most often: where to look.

CWE

Attack profile

All records

29 records
  • CVE-2022-25148
    63This week

    WP Statistics <= 13.1.5 Unauthenticated Blind SQL Injection via current_page_id

    CriticalCVSS 9.8Proof of conceptEPSS 81%

    veronalabs · wp statisticsFeb 24, 2022

  • CVE-2022-25149
    53Plan

    WP Statistics <= 13.1.5 Unauthenticated Blind SQL Injection via IP

    HighCVSS 7.5Proof of conceptEPSS 77%

    veronalabs · wp statisticsFeb 24, 2022

  • CVE-2022-25305
    48Plan

    WP Statistics <= 13.1.5 Unauthenticated Stored Cross-Site Scripting via IP

    MediumCVSS 6.1No exploitEPSS 79%

    veronalabs · wp statisticsFeb 24, 2022

  • CVE-2022-0513
    46Plan

    WP Statistics <= 13.1.4 Unauthenticated Blind SQL Injection via exclusion_reason

    HighCVSS 7.5No exploitEPSS 53%

    veronalabs · wp statisticsFeb 16, 2022

  • CVE-2022-4230
    46Plan

    WP Statistics < 13.2.9 - Authenticated SQLi

    HighCVSS 8.8No exploitEPSS 36%

    veronalabs · wp statisticsJan 23, 2023

  • CVE-2022-0651
    40Plan

    WP Statistics <= 13.1.5 Unauthenticated Blind SQL Injection via current_page_type

    HighCVSS 7.5Proof of conceptEPSS 32%

    veronalabs · wp statisticsFeb 24, 2022

  • CVE-2019-13275
    40Plan

    An issue was discovered in the VeronaLabs wp-statistics plugin before 12.6.7 for WordPress.

    CriticalCVSS 9.8No exploitEPSS 3%

    veronalabs · wp statisticsJul 4, 2019

  • CVE-2017-18515
    40Plan

    The wp-statistics plugin before 12.0.8 for WordPress has SQL injection.

    CriticalCVSS 9.8No exploitEPSS 3%

    veronalabs · wp statisticsAug 14, 2019

  • CVE-2021-24340
    39Monitor

    WP Statistics < 13.0.8 - Unauthenticated SQL Injection

    HighCVSS 7.5Proof of conceptEPSS 30%

    veronalabs · wp statisticsJun 7, 2021

  • CVE-2024-43331
    39Monitor

    WordPress WP SMS plugin <= 6.9.3 - Broken Access Control vulnerability

    CriticalCVSS 9.8No exploitEPSS 0%

    veronalabs · wp smsAug 22, 2024

  • CVE-2023-0955
    35Monitor

    WP Statistics < 14.0 - Authenticated SQLi

    HighCVSS 8.8No exploitEPSS 1%

    veronalabs · wp statisticsMar 27, 2023

  • CVE-2022-38074
    35Monitor

    WordPress WP Statistics Plugin <= 13.2.10 is vulnerable to SQL Injection

    HighCVSS 8.8No exploitEPSS 1%

    veronalabs · wp statisticsMar 13, 2023

  • CVE-2024-30454
    35Monitor

    WordPress WP SMS plugin <= 6.6.2 - Cross Site Request Forgery (CSRF) vulnerability

    HighCVSS 8.8No exploitEPSS 0%

    veronalabs · wp smsMar 29, 2024

  • CVE-2023-27447
    30Monitor

    WordPress WP SMS Plugin <= 6.0.4 is vulnerable to Sensitive Data Exposure

    HighCVSS 7.5No exploitEPSS 1%

    veronalabs · wp smsDec 28, 2023

  • CVE-2021-4333
    26Monitor

    WP Statistics <= 13.1.1 - Cross-Site Request Forgery to Arbitrary Plugin Activation and Deactivation

    MediumCVSS 6.5No exploitEPSS 0%

    veronalabs · wp statisticsMar 7, 2023

  • CVE-2019-10864
    24Monitor

    The WP Statistics plugin through 12.6.2 for WordPress has XSS, allowing a remote attacker to inject arbitrary web script or HTML via the Ref

    MediumCVSS 6.1No exploitEPSS 1%

    veronalabs · wp statisticsApr 23, 2019

  • CVE-2022-25307
    24Monitor

    WP Statistics <= 13.1.5 Unauthenticated Stored Cross-Site Scripting via platform

    MediumCVSS 6.1No exploitEPSS 1%

    veronalabs · wp statisticsFeb 24, 2022

  • CVE-2022-25306
    24Monitor

    WP Statistics <= 13.1.5 Unauthenticated Stored Cross-Site Scripting via browser

    MediumCVSS 6.1No exploitEPSS 1%

    veronalabs · wp statisticsFeb 24, 2022

  • CVE-2022-27231
    24Monitor

    Cross-site scripting vulnerability exists in WP Statistics versions prior to 13.2.0 because it improperly processes a platform parameter.

    MediumCVSS 6.1No exploitEPSS 1%

    veronalabs · wp statisticsJun 13, 2022

  • CVE-2022-1005
    24Monitor

    WP Statistics < 13.2.2 - Reflected Cross-Site Scripting

    MediumCVSS 6.1No exploitEPSS 1%

    veronalabs · wp statisticsJun 8, 2022

  • CVE-2018-1000556
    24Monitor

    WordPress version 4.8 + contains a Cross Site Scripting (XSS) vulnerability in plugins.php or core wordpress on delete function that can res

    MediumCVSS 6.1No exploitEPSS 1%

    veronalabs · wp statisticsJun 26, 2018

  • CVE-2023-32742
    24Monitor

    WordPress WP SMS Plugin <= 6.1.4 is vulnerable to Cross Site Scripting (XSS)

    MediumCVSS 6.1No exploitEPSS 0%

    veronalabs · wp smsAug 30, 2023

  • CVE-2024-24881
    24Monitor

    WordPress WP SMS Plugin <= 6.5.2 is vulnerable to Cross Site Scripting (XSS)

    MediumCVSS 6.1No exploitEPSS 0%

    veronalabs · wp smsFeb 8, 2024

  • CVE-2019-12566
    21Monitor

    The WP Statistics plugin through 12.6.5 for Wordpress has stored XSS in includes/class-wp-statistics-pages.php.

    MediumCVSS 5.4No exploitEPSS 1%

    veronalabs · wp statisticsJun 2, 2019

  • CVE-2021-24561
    21Monitor

    WP SMS < 5.4.13 - Authenticated Stored Cross-Site Scripting

    MediumCVSS 5.4No exploitEPSS 1%

    veronalabs · wp smsAug 23, 2021