Exposición de WP-Statistics

Analytics, WordPress plugins
40
score de exposición
2860
sitios usan
0
en explotación
5
críticos
Análisis Vexday

O plugin WP-Statistics acumula 18 CVEs catalogadas, das quais 5 são classificadas como críticas, e sua taxa de exploração ativa está abaixo da média geral do catálogo CISA KEV, sem registros confirmados de exploração ativa no momento. O tipo de falha mais recorrente é CWE-89 (SQL Injection), o que indica exposição consistente a vetores de injeção de banco de dados — categoria de risco elevado em ambientes WordPress com acesso a dados sensíveis de audiência. A CVE mais perigosa em destaque, CVE-2022-25148, apresenta escore EPSS de 0,81, sinalizando alta probabilidade de tentativas de exploração na prática, mesmo sem registro formal no KEV. Instâncias que ainda executam versões vulneráveis devem tratar essa CVE como prioridade de correção imediata, independentemente da ausência de exploração confirmada pelo CISA.

CVEs

18 resultados
CVE-2022-25148CRITICALWP Statistics <= 13.1.5 Unauthenticated Blind SQL Injection via current_page_idEPSS 80.9%CVE-2022-25305HIGHWP Statistics <= 13.1.5 Unauthenticated Stored Cross-Site Scripting via IPEPSS 78.9%CVE-2022-25149CRITICALWP Statistics <= 13.1.5 Unauthenticated Blind SQL Injection via IPEPSS 78.0%CVE-2022-0513CRITICALWP Statistics <= 13.1.4 Unauthenticated Blind SQL Injection via exclusion_reasonEPSS 53.5%CVE-2022-4230HIGHWP Statistics < 13.2.9 - Authenticated SQLiEPSS 35.7%CVE-2022-0651CRITICALWP Statistics <= 13.1.5 Unauthenticated Blind SQL Injection via current_page_typeEPSS 32.2%CVE-2021-24340—WP Statistics < 13.0.8 - Unauthenticated SQL InjectionEPSS 29.8%CVE-2017-2136—Cross-site scripting vulnerability in WP Statistics version 12.0.4 and earlier allows remote attackers to inject arbitrary web script or HTMEPSS 2.6%CVE-2017-2135—Cross-site scripting vulnerability in WP Statistics version 12.0.1 and earlier allows remote attackers to inject arbitrary web script or HTMEPSS 1.7%CVE-2022-25306HIGHWP Statistics <= 13.1.5 Unauthenticated Stored Cross-Site Scripting via browserEPSS 1.4%CVE-2022-25307HIGHWP Statistics <= 13.1.5 Unauthenticated Stored Cross-Site Scripting via platformEPSS 1.4%CVE-2017-2147—Cross-site scripting vulnerability in WP Statistics version 12.0.4 and earlier allows remote attackers to inject arbitrary web script or HTMEPSS 1.3%CVE-2022-27231—Cross-site scripting vulnerability exists in WP Statistics versions prior to 13.2.0 because it improperly processes a platform parameter. ByEPSS 1.0%CVE-2023-0955HIGHWP Statistics < 14.0 - Authenticated SQLiEPSS 0.9%CVE-2022-1005—WP Statistics < 13.2.2 - Reflected Cross-Site ScriptingEPSS 0.9%CVE-2022-38074CRITICALWordPress WP Statistics Plugin <= 13.2.10 is vulnerable to SQL InjectionEPSS 0.7%CVE-2026-48839HIGHWordPress WP Statistics plugin <= 14.16.6 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2025-55716MEDIUMWordPress WP Statistics Plugin <= 14.15 - Broken Access Control VulnerabilityEPSS 0.2%