PT-2021-8380 · WordPress · Wp-Stats

Michael Kapfer + 1 · Published 2021-11-01 · Updated 2021-11-03 · CVE-2015-10001

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Medium

Base vector

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions WP-Stats WordPress plugin versions prior to 2.52

Description The issue allows an attacker to make logged-in high-privilege users change settings and set Cross-Site Scripting payloads due to the lack of a CSRF check when saving settings and the failure to escape some settings when outputting them.

Recommendations For WP-Stats WordPress plugin versions prior to 2.52, update to version 2.52 or later to resolve the issue. As a temporary workaround, consider restricting access to the settings page to minimize the risk of exploitation.

Exploit

Fix

CSRF

Weakness Enumeration

CWE-352

Related Identifiers

CVE-2015-10001

Affected Products

Wp-Stats

References · 3

• 🔥 https://openwall.com/lists/oss-security/2015/06/17/6 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2015-10001 · Security Note
• https://wpscan.com/vulnerability/f5c3dfea-7203-4a98-88ff-aa6a24d03734 · Note