WordPress Plugin Vulnerabilities
WP Statistics <= 8.4 - Unauthenticated Referer Header Stored XSS
Description
On the "Statistics > Visitors" screen the referer link is not filtered. Malicious JavaScript can be injected by an unauthenticated user. This simple cURL command with a custom referer header makes it possible: curl -H 'Referer: javascript:alert(location.href);' 'http://wp.dev'
Affects Plugins
Fixed in 8.5 References
Classification
Type
XSS
OWASP top 10
CWE
Miscellaneous
Submitter
SecuBeastTeam
Verified
No
WPVDB ID
Timeline
Publicly Published
2014-12-03 (about 11 years ago)
Added
2014-12-03 (about 11 years ago)
Last Updated
2021-01-19 (about 5 years ago)
WPScan 