CVE-2025-9816: falha de alta gravidade em veronalabs WP Statistics – Simple…
WP Statistics <= 14.5.4 - Unauthenticated Stored Cross-Site Scripting via User-Agent Header
Publicada em · Atualizada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
26Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 7.2epss 12%
The WP Statistics – The Most Popular Privacy-Friendly Analytics Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the User-Agent Header in all versions up to, and including, 14.5.4 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N
CVEs relacionadas — veronalabs WP Statistics – Simple…
No mesmo produto, das mais perigosas para as menos.
CVE-2024-2194HIGHWP Statistics <= 14.5 - Unauthenticated Stored Cross-Site ScriptingEPSS 63.2%CVE-2026-15780HIGHWP Statistics <= 14.16.8 - Unauthenticated Stored Cross-Site Scripting via 'utm_campaign' ParameterEPSS 0.6%CVE-2026-5231HIGHWP Statistics <= 14.16.4 - Unauthenticated Stored Cross-Site Scripting via 'utm_source' ParameterEPSS 0.5%CVE-2021-4333MEDIUMWP Statistics <= 13.1.1 - Cross-Site Request Forgery to Arbitrary Plugin Activation and DeactivationEPSS 0.4%CVE-2026-3488MEDIUMWP Statistics <= 14.16.4 - Missing Authorization to Authenticated (Subscriber+) Sensitive Information Exposure and Privacy Audit ManipulationEPSS 0.3%CVE-2025-3953MEDIUMWP Statistics – The Most Popular Privacy-Friendly Analytics Plugin <= 14.13.3 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Plugin Settings UpdateEPSS 0.3%