CVE-2022-25306: WP Statistics <= 13.1.5 Unauthenticated Stored Cross-Site Scripting via browser
The WP Statistics WordPress plugin is vulnerable to Cross-Site Scripting due to insufficient escaping and sanitization of the browser parameter found in the ~/includes/class-wp-statistics-visitor.php file which allows attackers to inject arbitrary web scripts onto several pages that execute when site administrators view a sites statistics, in versions up to and including 13.1.5.
Affected Software
Remediation
Information
Event History
Frequently Asked Questions
What is the severity of CVE-2022-25306?
The severity of CVE-2022-25306 is rated as high due to the potential for Cross-Site Scripting attacks.
How do I fix CVE-2022-25306?
To fix CVE-2022-25306, update the WP Statistics plugin to version 13.1.6 or later.
What are the risks associated with CVE-2022-25306?
CVE-2022-25306 allows attackers to inject arbitrary web scripts, potentially compromising site integrity and user data.
Which versions of WP Statistics are affected by CVE-2022-25306?
CVE-2022-25306 affects all versions of the WP Statistics plugin up to and including 13.1.5.
Where is CVE-2022-25306 located in the WP Statistics plugin?
CVE-2022-25306 is found in the ~/includes/class-wp-statistics-visitor.php file of the WP Statistics plugin.