The Burst Statistics – Privacy-Friendly WordPress Analytics (Google Analytics Alternative) plugin for WordPress is vulnerable to Authentication Bypass in versions 3.4.0 to 3.4.1.1. This is due to incorrect return-value handling in the ismainwpauthenticated() function when validating application passwords from the Authorization header. This makes it possible for unauthenticated attackers, with knowledge of an administrator username, to impersonate that administrator for the duration of the request by supplying any random Basic Authentication password achieving privilege escalation.

The Burst Statistics – Privacy-Friendly Analytics for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'bursttotalpageviewscount' custom meta field in all versions up to, and including, 1.5.6.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Note that this exploit only functions if the victim has the 'Show Toolbar when viewing site' option enabled in their profile.

Cross-Site Request Forgery (CSRF) vulnerability in Burst Statistics B.V. Burst Statistics allows Cross Site Request Forgery. This issue affects Burst Statistics: from n/a through 2.0.6.

The Burst Statistics – Simple WordPress Analytics (Google Analytics Alternative) plugin for WordPress is vulnerable to Improper Authentication leading to Account Persistence in all versions up to, and including, 3.7.1. This is due to the maybeloadshareddashboard() handler issuing a genuine WordPress session cookie for the burststatisticsviewer account to any visitor presenting a valid share token via wpsetauthcookie(), while the plugin only blocks Application Passwords for the resulting burstviewer role and does not restrict the core /wp-json/wp/v2/users/me password update endpoint or filter the edituser capability for that account — leaving WordPress core's built-in rule that any authenticated user may update their own account fully in effect. This makes it possible for unauthenticated attackers to set an attacker-chosen password on the burststatisticsviewer WordPress account, constituting a permanent takeover of that limited-privilege (viewburststatistics) account that persists through share-token revocation, share-token expiration, and execution of the plugin's daily cleanupviewersessions() routine. Exploitation requires that the attacker have obtained a valid burstsharetoken, such as one that has been shared publicly or distributed to an untrusted party.