CVE-2022-25306 — WP Statistics <= 13.1.5 Unauthenticated Stored Cross-Site Scripting via browser
The WP Statistics WordPress plugin is vulnerable to Cross-Site Scripting due to insufficient escaping and sanitization of the browser parameter found in the ~/includes/class-wp-…
Published: 2022-02-24 · CVSS: 7.2 · CVSS 3.1
The WP Statistics WordPress plugin is vulnerable to Cross-Site Scripting due to insufficient escaping and sanitization of the browser parameter found in the ~/includes/class-wp-statistics-visitor.php file which allows attackers to inject arbitrary web scripts onto several pages that execute when site administrators view a sites statistics, in versions up to and including 13.1.5.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7