WordPress Plugin Vulnerabilities

WP Statistics <= 9.4 - Authenticated SQL Injection

Description

The WP Statistics WordPress plugin was affected by an Authenticated SQL Injection security vulnerability.

Affects Plugins

Plugin icon
wp-statistics
Fixed in 9.4.1

References

URL
https://plugins.trac.wordpress.org/changeset/1195467
URL
http://cinu.pl/research/wp-plugins/mail_5ba1c082d4ba9ccd1997e15b799ea1f3.html
URL
http://blog.cinu.pl/2015/11/php-static-code-analysis-vs-top-1000-wordpress-plugins.html

Classification

Type
SQLI
OWASP top 10
A1: Injection
CWE
CWE-89

Miscellaneous

Submitter
ethicalhack3r
Submitter twitter
ethicalhack3r
Verified
No
WPVDB ID
b086b130-d7dd-421e-aab9-e8a07e563690

Timeline

Publicly Published
2015-07-09 (about 10 years ago)
Added
2015-07-26 (about 10 years ago)
Last Updated
2019-10-31 (about 6 years ago)

Other

Published
Title
Published
2019-01-14
Title
Companion Auto Update <= 3.3.5 - Authenticated SQL Injection
Published
2025-04-16
Title
Hostel < 1.1.5.7 - Authenticated (Administrator+) SQL Injection
Published
2026-01-27
Title
VidShop – Shoppable Videos for WooCommerce < 1.1.5 - Unauthenticated Time-Based SQL Injection via 'fields'
Published
2024-04-26
Title
Timetable and Event Schedule by MotoPress < 2.4.12 - Authenticated (Contributor+) SQL Injection
Published
2024-09-18
Title
Website File Changes < 2.1.0 - Admin+ Authenticated SQL Injection