Updated 1 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,766exploited flaws on CISA’s list

37added in the last 30 days

544new WordPress flaws this week

391,181entries in the database

48 results

Sep 30, 2026Post Views Stats Counter: Stored Cross-Site ScriptingCVE-2026-97347 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The Post Views Stats Counter plugin for WordPress is vulnerable to Stored Cross-Site Scripting via User-Agent Header in all versions up to, and including, 1.1.7 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The plugin's only input filter is a substring blacklist for known bot signatures (e.g. 'bot', 'spider', 'crawler'), which can be trivially bypassed by crafting a User-Agent payload that omits those strings.
Product
Post Views Stats Counter
Affected
up to 1.1.7
What to do
Affects up to 1.1.7. Update Post Views Stats Counter to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Aug 14, 2026WP-Stats: Stored Cross-Site ScriptingCVE-2026-19794 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The WP-Stats plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 2.56 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
WP-Stats
Affected
up to 2.56
What to do
Affects up to 2.56. Update WP-Stats to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com wordfence.com
Aug 13, 2026Unauthenticated Cross Site Scripting (XSS) in WP-Stats <= 2.56 versions.CVE-2026-66426 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Unauthenticated Cross Site Scripting (XSS) in WP-Stats <= 2.56 versions.
Affected
up to 2.56
What to do
Affects up to 2.56. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
May 29, 2026StatCounter – Free Real Time Visitor Stats: Stored Cross-Site ScriptingCVE-2026-6275 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The StatCounter – Free Real Time Visitor Stats plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 2.1.1 This is due to insufficient output escaping on the post author's nickname in the statcounter_addToTags() function. The function is hooked to wp_head and fires on every single post page. It retrieves the post author's nickname via the_author_meta() and echoes it directly into a JavaScript double-quoted string context inside a <script> block without applying esc_js() or any equivalent JavaScript-context escaping. This makes it possible for authenticated attackers with Author-level access and above to inject arbitrary web scripts into pages that will execute whenever any user (including unauthenticated visitors) accesses a post authored by the attacker.
Product
StatCounter – Free Real Time Visitor Stats
Affected
up to 2.1.1
What to do
Affects up to 2.1.1. Update StatCounter – Free Real Time Visitor Stats to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
May 27, 2026GoStats for: Cross-Site Request ForgeryCVE-2026-8943 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The GoStats for WordPress plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.4. This is due to missing or incorrect nonce validation on the gostats_manage() function. This makes it possible for unauthenticated attackers to update the plugin's settings (gostats_siteid and gostats_server options) via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Product
GoStats for
Affected
up to 1.4
What to do
Affects up to 1.4. Update GoStats for to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
May 12, 2026MonsterInsights – Google Analytics Dashboard for WordPress (Website Stats Made Easy): Unauthorized access and modification of dataCVE-2026-5371 · WordPress plugins & themes · reported by WordfenceHigh 7.1
The MonsterInsights – Google Analytics Dashboard for WordPress (Website Stats Made Easy) plugin for WordPress is vulnerable to unauthorized access and modification of data due to a missing capability checks on the get_ads_access_token() and reset_experience() functions in all versions up to, and including, 10.1.2. This makes it possible for authenticated attackers, with Subscriber-level access and above, to retrieve live Google OAuth access tokens and reset Plugins's Google Ads integration.
Product
MonsterInsights – Google Analytics Dashboard for WordPress (Website Stats Made Easy)
Affected
up to 10.1.2
What to do
Affects up to 10.1.2. Update MonsterInsights – Google Analytics Dashboard for WordPress (Website Stats Made Easy) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
May 10, 2026WordPress 3dady Real-Time Web Stats plugin 1.0 contains a stored cross-site scripting vulnerability that allows authenticated attackers to inject malicious JavaCVE-2022-50945 · WordPress plugins & themes · reported by VulnCheckMedium 5.1
WordPress 3dady Real-Time Web Stats plugin 1.0 contains a stored cross-site scripting vulnerability that allows authenticated attackers to inject malicious JavaScript by exploiting unsanitized input fields. Attackers can insert JavaScript payloads in the dady_input_text or dady2_input_text fields via the plugin options panel to execute arbitrary code when the page is viewed.
What to do
Update the plugin to the newest version.
Full record and what to do →NVD record profiles.wordpress.org exploit-db.com
Apr 23, 2026ExactMetrics – Google Analytics Dashboard for WordPress (Website Stats Plugin): Unauthorized arbitrary plugin installation and activationCVE-2026-5464 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The ExactMetrics – Google Analytics Dashboard for WordPress (Website Stats Plugin) plugin for WordPress is vulnerable to unauthorized arbitrary plugin installation and activation in all versions up to, and including, 9.1.2. This is due to the reports page exposing the 'onboarding_key' transient to any user with the 'exactmetrics_view_dashboard' capability. This key is the sole authorization gate for the '/wp-json/exactmetrics/v1/onboarding/connect-url' REST endpoint, which returns a one-time hash (OTH) token. This OTH token is then the only credential checked by the 'exactmetrics_connect_process' AJAX endpoint — which has no capability check, no nonce verification, and accepts an arbitrary plugin ZIP URL via the file parameter for installation and activation. This makes it possible for authenticated attackers, with Editor-level access and above granted the report viewing permission, to install and activate arbitrary plugins from attacker-controlled URLs, leading to Remote Code Execution.
Product
ExactMetrics – Google Analytics Dashboard for WordPress (Website Stats Plugin)
Affected
up to 9.1.2
What to do
Affects up to 9.1.2. Update ExactMetrics – Google Analytics Dashboard for WordPress (Website Stats Plugin) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Feb 19, 2026StatCounter – Free Real Time Visitor Stats: Stored Cross-Site ScriptingCVE-2025-13048 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The StatCounter – Free Real Time Visitor Stats plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the user's Nickname in all versions up to, and including, 2.1.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
StatCounter – Free Real Time Visitor Stats
Affected
up to 2.1.0
What to do
Affects up to 2.1.0. Update StatCounter – Free Real Time Visitor Stats to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jan 8, 2026Visitor Stats Widget: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-68874 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Shahjada Visitor Stats Widget visitor-stats-widget allows Reflected XSS.This issue affects Visitor Stats Widget: from n/a through <= 1.5.0.
Product
Visitor Stats Widget
Affected
up to 1.5.0
What to do
Affects up to 1.5.0. Update Visitor Stats Widget to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 4, 2025Clik stats: Reflected Cross-Site ScriptingCVE-2025-13513 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The Clik stats plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the `$_SERVER['PHP_SELF']` parameter in all versions up to, and including, 0.8 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
Product
Clik stats
Affected
up to 0.8
What to do
Affects up to 0.8. Update Clik stats to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Oct 11, 2025Easy Plugin Stats: Stored Cross-Site ScriptingCVE-2025-7652 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Easy Plugin Stats plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'eps' shortcode in all versions up to, and including, 2.0.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Easy Plugin Stats
Affected
up to 2.0.1
What to do
Affects up to 2.0.1. Update Easy Plugin Stats to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wordpress.org wordfence.com
Jun 6, 2025WP Online Users Stats: Cross-Site Request ForgeryCVE-2025-4966 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The WP Online Users Stats plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0.0. This is due to missing nonce validation within the hk_dataset_results() function. This makes it possible for unauthenticated attackers to inject malicious web scripts via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Product
WP Online Users Stats
Affected
up to 1.0.0
What to do
Affects up to 1.0.0. Update WP Online Users Stats to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordpress.org
Jun 6, 2025WP Online Users Stats: Time-based SQL InjectionCVE-2025-4964 · WordPress plugins & themes · reported by WordfenceMedium 4.9
The WP Online Users Stats plugin for WordPress is vulnerable to time-based SQL Injection via the ‘table_name’ parameter in all versions up to, and including, 1.0.0 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with Editor-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
Product
WP Online Users Stats
Affected
up to 1.0.0
What to do
Affects up to 1.0.0. Update WP Online Users Stats to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordpress.org
May 23, 20254stats: Cross-Site Request ForgeryCVE-2025-3869 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The 4stats plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.0.9. This is due to missing or incorrect nonce validation on the stats/stats.php page. This makes it possible for unauthenticated attackers to update settings and inject malicious web scripts via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Product
4stats
Affected
up to 2.0.9
What to do
Affects up to 2.0.9. Update 4stats to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordpress.org
May 23, 2025kStats Reloaded: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-46440 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Mark kStats Reloaded kstats-reloaded allows Reflected XSS.This issue affects kStats Reloaded: from n/a through <= 0.7.4.
Product
kStats Reloaded
Affected
up to 0.7.4
What to do
Affects up to 0.7.4. Update kStats Reloaded to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
May 7, 2025Simple Blog Stats: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-47499 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Jeff Starr Simple Blog Stats simple-blog-stats allows Stored XSS.This issue affects Simple Blog Stats: from n/a through <= 20250416.
Product
Simple Blog Stats
Affected
up to 20250416
What to do
Affects up to 20250416. Update Simple Blog Stats to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Apr 11, 2025WP Online Users Stats: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-32603 · WordPress plugins & themes · reported by PatchstackCritical 9.3
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in HK WP Online Users Stats wp-online-users-stats allows Blind SQL Injection.This issue affects WP Online Users Stats: from n/a through <= 1.0.0.
Product
WP Online Users Stats
Affected
up to 1.0.0
What to do
Affects up to 1.0.0. Update WP Online Users Stats to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Apr 9, 2025WP Show Stats: Cross-Site Request Forgery (CSRF)CVE-2025-32678 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in Ashish Ajani WP Show Stats wp-show-stats allows Cross Site Request Forgery.This issue affects WP Show Stats: from n/a through <= 1.5.
Product
WP Show Stats
Affected
up to 1.5
What to do
Affects up to 1.5. Update WP Show Stats to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Apr 1, 2025Kento WordPress Stats: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-30559 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in PluginsPoint Kento WordPress Stats kento-wp-stats allows Stored XSS.This issue affects Kento WordPress Stats: from n/a through <= 1.1.
Product
Kento WordPress Stats
Affected
up to 1.1
What to do
Affects up to 1.1. Update Kento WordPress Stats to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 15, 2025pixelstats: Reflected Cross-Site ScriptingCVE-2025-2164 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The pixelstats plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'post_id' and 'sortby' parameters in all versions up to, and including, 0.8.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
Product
pixelstats
Affected
up to 0.8.2
What to do
Affects up to 0.8.2. Update pixelstats to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Mar 11, 2025W3Counter Free Real-Time Web Stats: Cross-Site Request Forgery (CSRF)CVE-2025-28856 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in dangrossman W3Counter Free Real-Time Web Stats blog-stats-by-w3counter allows Cross Site Request Forgery.This issue affects W3Counter Free Real-Time Web Stats: from n/a through <= 4.1.
Product
W3Counter Free Real-Time Web Stats
Affected
up to 4.1
What to do
Affects up to 4.1. Update W3Counter Free Real-Time Web Stats to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 3, 2025Wibstats: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23565 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Chris Taylor Wibstats wibstats-statistics-for-wordpress-mu allows Reflected XSS.This issue affects Wibstats: from n/a through <= 0.5.5.
Product
Wibstats
Affected
up to 0.5.5
What to do
Affects up to 0.5.5. Update Wibstats to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 2, 2024IceStats: Cross-Site Request Forgery (CSRF)CVE-2024-53724 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in ronnybull IceStats icestats allows Stored XSS.This issue affects IceStats: from n/a through <= 1.3.
Product
IceStats
Affected
up to 1.3
What to do
Affects up to 1.3. Update IceStats to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Sep 23, 2024Seriously Simple Stats: Reflected Cross-Site ScriptingCVE-2024-8738 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The Seriously Simple Stats plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg without appropriate escaping on the URL in all versions up to, and including, 1.6.0. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
Product
Seriously Simple Stats
Affected
up to 1.6.0
What to do
Affects up to 1.6.0. Update Seriously Simple Stats to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
May 3, 2024GWP-Histats: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-33926 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Karl Kiesinger GWP-Histats allows Stored XSS.This issue affects GWP-Histats: from n/a through 1.0.
Product
GWP-Histats
Affected
up to 1.0
What to do
Affects up to 1.0. Update GWP-Histats to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 12, 2024WP Server Health Stats: Cross-Site Request Forgery (CSRF)CVE-2024-31250 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in Saumya Majumder WP Server Health Stats.This issue affects WP Server Health Stats: from n/a through 1.7.3.
Product
WP Server Health Stats
Affected
up to 1.7.3
What to do
Affects up to 1.7.3. Update WP Server Health Stats to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Feb 28, 2024Matomo Analytics – Ethical Stats. Powerful Insights.: Reflected Cross-Site ScriptingCVE-2023-6923 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The Matomo Analytics – Ethical Stats. Powerful Insights. plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the idsite parameter in all versions up to, and including, 4.15.3 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
Product
Matomo Analytics – Ethical Stats. Powerful Insights.
Affected
up to 4.15.3
What to do
Affects up to 4.15.3. Update Matomo Analytics – Ethical Stats. Powerful Insights. to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Jan 31, 2024Post views Stats: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-22289 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in CyberNetikz Post views Stats post-views-stats allows DOM-Based XSS.This issue affects Post views Stats: from n/a through <= 1.4.1.
Product
Post views Stats
Affected
up to 1.4.1
What to do
Affects up to 1.4.1. Update Post views Stats to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jan 17, 2024Track The Click: Does not properly sanitize query parameters to the stats REST endpoint before using them in a database queryCVE-2023-5041 · WordPress plugins & themes · reported by WPScanHigh 8.8
The Track The Click WordPress plugin before 0.3.12 does not properly sanitize query parameters to the stats REST endpoint before using them in a database query, allowing a logged in user with an author role or higher to perform time based blind SQLi attacks on the database.
Product
Track The Click
Fixed in
0.3.12
What to do
Update Track The Click to 0.3.12 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Nov 7, 2023Posts and Users Stats: Improper Neutralization of Formula Elements in a CSV FileCVE-2022-44738 · WordPress plugins & themes · reported by PatchstackMedium 5.8
Improper Neutralization of Formula Elements in a CSV File vulnerability in Patrick Robrecht Posts and Users Stats.This issue affects Posts and Users Stats: from n/a through 1.1.3.
Product
Posts and Users Stats
Affected
up to 1.1.3
What to do
Affects up to 1.1.3. Update Posts and Users Stats to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Nov 6, 2023Seriously Simple Stats: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2023-45001 · WordPress plugins & themes · reported by PatchstackHigh 8.5
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Castos Seriously Simple Stats allows SQL Injection.This issue affects Seriously Simple Stats: from n/a through 1.5.0.
Product
Seriously Simple Stats
Affected
up to 1.5.0
What to do
Affects up to 1.5.0. Update Seriously Simple Stats to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Oct 12, 2023Cross-Site Request Forgery (CSRF) vulnerability in Igor Buyanov WP Power Stats plugin <= 2.2.3 versions.CVE-2023-45011 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in Igor Buyanov WP Power Stats plugin <= 2.2.3 versions.
Affected
up to 2.2.3
What to do
Affects up to 2.2.3. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Sep 16, 2022WP Server Health Stats: Does not escape some of its settingsCVE-2022-2887 · WordPress plugins & themes · reported by WPScanMedium 4.8
The WP Server Health Stats WordPress plugin before 1.7.0 does not escape some of its settings, which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed.
Product
WP Server Health Stats
Fixed in
1.7.0
What to do
Update WP Server Health Stats to 1.7.0 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Nov 8, 2021Simple Download Monitor: Does not escape the 1) sdm_active_tab GET parameter and 2) sdm_stats_start_date/sdm_stats_end_date POST parameters before outputting them back in attributesCVE-2021-24697 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Simple Download Monitor WordPress plugin before 3.9.5 does not escape the 1) sdm_active_tab GET parameter and 2) sdm_stats_start_date/sdm_stats_end_date POST parameters before outputting them back in attributes, leading to Reflected Cross-Site Scripting issues
Product
Simple Download Monitor
Fixed in
3.9.5
What to do
Update Simple Download Monitor to 3.9.5 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Nov 1, 2021WP-Stats: Does not have CSRF checkCVE-2015-10001 · WordPress plugins & themes · reported by WPScanMedium 4.3
The WP-Stats WordPress plugin before 2.52 does not have CSRF check when saving its settings, and did not escape some of them when outputting them, allowing attacker to make logged in high privilege users change them and set Cross-Site Scripting payloads
Product
WP-Stats
Fixed in
2.52
What to do
Update WP-Stats to 2.52 or newer.
Full record and what to do →NVD record wpscan.com openwall.com
Aug 30, 2021ShareThis Dashboard for Google Analytics: Does not sanitise or escape the 'ga_action' parameter in the stats view before outputting it back in an attributeCVE-2021-24438 · WordPress plugins & themes · reported by WPScanMedium 6.1
The ShareThis Dashboard for Google Analytics WordPress plugin before 2.5.2 does not sanitise or escape the 'ga_action' parameter in the stats view before outputting it back in an attribute when the plugin is connected to a Google Analytics account, leading to a reflected Cross-Site Scripting issue which will be executed in the context of a logged in administrator
Product
ShareThis Dashboard for Google Analytics
Fixed in
2.5.2
What to do
Update ShareThis Dashboard for Google Analytics to 2.5.2 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Aug 9, 2021Page View Count: Does not escape the postid parameter of pvc_stats shortcodeCVE-2021-24509 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Page View Count WordPress plugin before 2.4.9 does not escape the postid parameter of pvc_stats shortcode, allowing users with a role as low as Contributor to perform Stored XSS attacks. A post made by a contributor would still have to be approved by an admin to have the XSS triggered in the frontend, however, higher privilege users, such as editor could exploit this without the need of approval, and even when the blog disallows the unfiltered_html capability.
Product
Page View Count
Fixed in
2.4.9
What to do
Update Page View Count to 2.4.9 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Apr 30, 2020the stats() method of class-wp-object-cache.php can be exploited to execute cross-site scripting: In affected versions of WordPress, aCVE-2020-11029 · WordPress plugins & themes · reported by GitHubMedium 5.8
In affected versions of WordPress, a vulnerability in the stats() method of class-wp-object-cache.php can be exploited to execute cross-site scripting (XSS) attacks. This has been patched in version 5.4.1, along with all the previously affected versions via a minor release (5.3.3, 5.2.6, 5.1.5, 5.0.9, 4.9.14, 4.8.13, 4.7.17, 4.6.18, 4.5.21, 4.4.22, 4.3.23, 4.2.27, 4.1.30, 4.0.30, 3.9.31, 3.8.33, 3.7.33).
Product
the stats() method of class-wp-object-cache.php can be exploited to execute cross-site scripting
What to do
Update the stats() method of class-wp-object-cache.php can be exploited to execute cross-site scripting to the newest version.
Full record and what to do →NVD record github.com lists.debian.org
Sep 20, 2019The wp-stats-dashboard plugin through 2.9.4 for WordPress has admin/graph_trend.php type SQL injection.CVE-2015-9399 · WordPress plugins & themes · reported by MITREHigh 7.2
The wp-stats-dashboard plugin through 2.9.4 for WordPress has admin/graph_trend.php type SQL injection.
Product
wp-stats-dashboard
Affected
up to 2.9.4
What to do
Affects up to 2.9.4. Update wp-stats-dashboard to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record cinu.pl wordpress.org
Aug 22, 2019The wassup plugin before 1.9.1 for WordPress has XSS via the Top stats widget or the wassupURI::add_siteurl method, a different vulnerability than CVE-2012-2633CVE-2016-10919 · WordPress plugins & themes · reported by MITREMedium 6.1
The wassup plugin before 1.9.1 for WordPress has XSS via the Top stats widget or the wassupURI::add_siteurl method, a different vulnerability than CVE-2012-2633.
Product
wassup
Fixed in
1.9.1
What to do
Update wassup to 1.9.1 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Sep 15, 2018The Feed Statistics plugin before 4.0 for WordPress has an Open Redirect via the feed-stats-url parameter.CVE-2018-17074 · WordPress plugins & themes · reported by MITREMedium 6.1
The Feed Statistics plugin before 4.0 for WordPress has an Open Redirect via the feed-stats-url parameter.
Product
Feed Statistics
Fixed in
4.0
What to do
Update Feed Statistics to 4.0 or newer.
Full record and what to do →NVD record hackerone.com plugins.trac.wordpress.org
Dec 20, 2017Multiple cross-site scripting (XSS) vulnerabilities in ui_stats.php in the bSuite plugin before 5 alpha 3 for WordPress allow remote attackers to inject arbitraCVE-2011-4955 · WordPress plugins & themes · reported by Red HatMedium 6.1
Multiple cross-site scripting (XSS) vulnerabilities in ui_stats.php in the bSuite plugin before 5 alpha 3 for WordPress allow remote attackers to inject arbitrary web script or HTML via the (1) s or (2) p parameters to index.php.
Product
bSuite
Fixed in
5
What to do
Update bSuite to 5 or newer.
Full record and what to do →NVD record plugins.trac.wordpress.org secunia.com
Jul 2, 2014Cross-site scripting (XSS) vulnerability in cal/test.php in the ZdStatistics (zdstats) plugin 2.0.1 and earlier for WordPress allows remote attackers to inject CVE-2014-4605 · WordPress plugins & themes · reported by MITREMedium 4.3
Cross-site scripting (XSS) vulnerability in cal/test.php in the ZdStatistics (zdstats) plugin 2.0.1 and earlier for WordPress allows remote attackers to inject arbitrary web script or HTML via the lang parameter.
Product
ZdStatistics (zdstats)
Affected
up to 2.0.1
What to do
Affects up to 2.0.1. Update ZdStatistics (zdstats) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record codevigilant.com codevigilant.com
Jun 22, 2009SQL injection vulnerability in the FireStats plugin before 1.6.2-stable for WordPress allows remote attackers to execute arbitrary SQL commands via unspecified CVE-2009-2144 · WordPress plugins & themes · reported by MITREHigh 7.5
SQL injection vulnerability in the FireStats plugin before 1.6.2-stable for WordPress allows remote attackers to execute arbitrary SQL commands via unspecified vectors.
Product
SQL injection vulnerability in the FireStats
Fixed in
1.6.2-stable
What to do
Update SQL injection vulnerability in the FireStats to 1.6.2-stable or newer.
Full record and what to do →NVD record firestats.cc secunia.com
Jun 22, 2009PHP remote file inclusion vulnerability in firestats-wordpress.php in the FireStats plugin before 1.6.2-stable for WordPress allows remote attackers to execute CVE-2009-2143 · WordPress plugins & themes · reported by MITREHigh 7.5
PHP remote file inclusion vulnerability in firestats-wordpress.php in the FireStats plugin before 1.6.2-stable for WordPress allows remote attackers to execute arbitrary PHP code via a URL in the fs_javascript parameter.
Product
PHP remote file inclusion vulnerability in firestats-wordpress.php in the FireStats
Fixed in
1.6.2-stable
What to do
Update PHP remote file inclusion vulnerability in firestats-wordpress.php in the FireStats to 1.6.2-stable or newer.
Full record and what to do →NVD record firestats.cc secunia.com
Jul 31, 2007Multiple cross-site scripting (XSS) vulnerabilities in the WP-FeedStats before 2.4 plugin for WordPress allow remote attackers to inject arbitrary web script orCVE-2007-4104 · WordPress plugins & themes · reported by MITREMedium 4.3
Multiple cross-site scripting (XSS) vulnerabilities in the WP-FeedStats before 2.4 plugin for WordPress allow remote attackers to inject arbitrary web script or HTML via unspecified vectors, one of which involves an rss2 feed with an invalid or missing blog with an XSS sequence in the query string.
Fixed in
2.4
What to do
Update the plugin to 2.4 or newer.
Full record and what to do →NVD record blogsecurity.net blogsecurity.net
Jun 20, 2007the skeltoac stats: Cross-site scripting (XSS)CVE-2007-3288 · WordPress plugins & themes · reported by MITREMedium 4.3
Cross-site scripting (XSS) vulnerability in the skeltoac stats (Automattic Stats) 1.0 plugin for WordPress allows remote attackers to inject arbitrary web script or HTML via the HTTP Referer field.
Product
the skeltoac stats
What to do
Update the skeltoac stats to the newest version.
Full record and what to do →NVD record osvdb.org securityreason.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.