CVE-2024-2194: WP Statistics <= 14.5 - Unauthenticated Stored Cross-Site Scripting
The WP Statistics plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the URL search parameter in all versions up to, and including, 14.5 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2024-2194?
CVE-2024-2194 has been classified as a high severity vulnerability due to the potential for exploitation through Stored Cross-Site Scripting.
How do I fix CVE-2024-2194?
To fix CVE-2024-2194, update the WP Statistics plugin to version 14.6 or later, which includes the necessary security patches.
Who is affected by CVE-2024-2194?
CVE-2024-2194 affects all versions of the WP Statistics plugin up to and including version 14.5.
What type of attack does CVE-2024-2194 enable?
CVE-2024-2194 enables unauthenticated attackers to perform Stored Cross-Site Scripting attacks via manipulation of the URL search parameter.
Is user authentication required to exploit CVE-2024-2194?
No, CVE-2024-2194 can be exploited by unauthenticated attackers, making it particularly dangerous.