WP Statistics – Simple, privacy-friendly Google Analytics alternative

Уязвимости

• CVE-2022-25148без авторизации≤ 13.1.5

  WP Statistics <= 13.1.5 Unauthenticated Blind SQL Injection via current_page_id

  Критич. 9.8

• CVE-2017-18515без авторизации

  The wp-statistics plugin before 12.0.8 for WordPress has SQL injection.

  Критич. 9.8

• CVE-2019-13275без авторизации

  An issue was discovered in the VeronaLabs wp-statistics plugin before 12.6.7 for WordPress.

  Критич. 9.8

• CVE-2022-38074нужен вход≤ 13.2.10

  WordPress WP Statistics Plugin <= 13.2.10 is vulnerable to SQL Injection

  Высокий 8.8

• CVE-2022-25149без авторизации≤ 13.1.5

  WP Statistics <= 13.1.5 Unauthenticated Blind SQL Injection via IP

  Высокий 7.5

• CVE-2022-0651без авторизации≤ 13.1.5

  WP Statistics <= 13.1.5 Unauthenticated Blind SQL Injection via current_page_type

  Высокий 7.5

• CVE-2022-0513без авторизации≤ 13.1.4

  WP Statistics <= 13.1.4 Unauthenticated Blind SQL Injection via exclusion_reason

  Высокий 7.5

• CVE-2026-15780без авторизации≤ 14.16.8

  WP Statistics <= 14.16.8 - Unauthenticated Stored Cross-Site Scripting via 'utm_campaign' Parameter

  Высокий 7.2

• CVE-2026-5231без авторизации≤ 14.16.4

  WP Statistics <= 14.16.4 - Unauthenticated Stored Cross-Site Scripting via 'utm_source' Parameter

  Высокий 7.2

• CVE-2025-9816без авторизации≤ 14.15.4

  WP Statistics <= 14.5.4 - Unauthenticated Stored Cross-Site Scripting via User-Agent Header

  Высокий 7.2

• CVE-2024-2194без авторизации≤ 14.5

  WP Statistics <= 14.5 - Unauthenticated Stored Cross-Site Scripting

  Высокий 7.2

• CVE-2026-93770без авторизации · нужен клик≤ 14.16.13

  WordPress WP Statistics plugin <= 14.16.13 - Cross Site Scripting (XSS) vulnerability

  Высокий 7.1

• CVE-2026-48839без авторизации · нужен клик≤ 14.16.6

  WordPress WP Statistics plugin <= 14.16.6 - Cross Site Scripting (XSS) vulnerability

  Высокий 7.1

• CVE-2021-4333без авторизации · нужен клик≤ 13.1.1

  WP Statistics <= 13.1.1 - Cross-Site Request Forgery to Arbitrary Plugin Activation and Deactivation

  Средний 6.5

• CVE-2026-3488подписчик+≤ 14.16.4

  WP Statistics <= 14.16.4 - Missing Authorization to Authenticated (Subscriber+) Sensitive Information Exposure and Privacy Audit Manipulation

  Средний 6.5

• CVE-2026-97652без авторизации · нужен клик≤ 14.16.14

  WP Statistics <= 14.16.14 - Reflected Cross-Site Scripting via REQUEST_URI Query-Parameter Key

  Средний 6.1

• CVE-2026-84774без авторизации · нужен клик≤ 14.16.11

  WordPress WP Statistics plugin <= 14.16.11 - Cross Site Scripting (XSS) vulnerability

  Средний 6.1

• CVE-2022-27231без авторизации · нужен клик

  Cross-site scripting vulnerability exists in WP Statistics versions prior to 13.2.0 because it improperly processes a platform parameter.

  Средний 6.1

• CVE-2022-25307без авторизации≤ 13.1.5

  WP Statistics <= 13.1.5 Unauthenticated Stored Cross-Site Scripting via platform

  Средний 6.1

• CVE-2022-25306без авторизации≤ 13.1.5

  WP Statistics <= 13.1.5 Unauthenticated Stored Cross-Site Scripting via browser

  Средний 6.1

• CVE-2022-25305без авторизации≤ 13.1.5

  WP Statistics <= 13.1.5 Unauthenticated Stored Cross-Site Scripting via IP

  Средний 6.1

• CVE-2025-3953подписчик+≤ 14.13.3

  WP Statistics – The Most Popular Privacy-Friendly Analytics Plugin <= 14.13.3 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Plugin Settings U

  Средний 5.4

• CVE-2019-12566нужен вход

  The WP Statistics plugin through 12.6.5 for Wordpress has stored XSS in includes/class-wp-statistics-pages.php.

  Средний 5.4

• CVE-2025-55716нужен вход≤ 14.15

  WordPress WP Statistics Plugin <= 14.15 - Broken Access Control Vulnerability

  Средний 4.3