PT-2025-41675 · WordPress · Easy Plugin Stats

Dj + 1 · Published 2025-10-11 · Updated 2025-10-11 · CVE-2025-7652

Positive Technologies (AI Summary)

CVSS v3.1

6.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Easy Plugin Stats versions prior to 2.0.2

Description The Easy Plugin Stats plugin for WordPress has a flaw that allows malicious code to be stored and executed when a user views a page containing the injected code. This is due to a lack of proper sanitization and escaping of user-provided information within the 'eps' shortcode. An attacker with contributor-level access or higher can inject arbitrary web scripts into pages. These scripts will then run when any user accesses the affected page.

Recommendations Update Easy Plugin Stats to version 2.0.2 or later.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2025-7652

Affected Products

Easy Plugin Stats

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2025-7652 · Security Note
• https://wordfence.com/threat-intel/vulnerabilities/id/290a790f-7d11-4be7-9146-cb07919b1e60?source=cve · Note
• https://wordpress.org/plugins/easy-plugin-stats · Note
• https://twitter.com/CVEnew/status/1976948526468022642 · Twitter Post
• https://t.me/CVEtracker/34668 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1977039847157059908 · Twitter Post