WP-Stats < 2.5.2 - CSRF to Stored Cross-Site Scripting (XSS)
CVE-2015-10001

4.3MEDIUM

Key Information:

Vendor
Wordpress
Status
WP-stats
Vendor
CVE Published:
1 November 2021

Summary

The WP-Stats WordPress plugin before 2.52 does not have CSRF check when saving its settings, and did not escape some of them when outputting them, allowing attacker to make logged in high privilege users change them and set Cross-Site Scripting payloads

Affected Version(s)

WP-Stats 2.52

References

https://wpscan.com/vulnerability/f5c3dfea-7203-4a98-88ff-...
x_refsource_MISC
https://www.openwall.com/lists/oss-security/2015/06/17/6
x_refsource_MISC

CVSS V3.1

Score:
4.3
Severity:
MEDIUM
Confidentiality:
None
Integrity:
Low
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Sebastian Wolfgang Kraemer
.