WordPress Plugin Vulnerabilities

Post views Stats < 1.5 - Reflected Cross-Site Scripting via from and to

Description

The plugin is vulnerable to Reflected Cross-Site Scripting via the 'from’ and 'to' parameters due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.

Affects Plugins

Plugin icon
post-views-stats
Fixed in 1.5

References

CVE
CVE-2024-22289
URL
https://vdp.patchstack.com/database/wordpress/plugin/post-views-stats/vulnerability/wordpress-post-views-stats-plugin-1-3-reflected-cross-site-scripting-xss-vulnerability

Classification

Type
XSS
OWASP top 10
A7: Cross-Site Scripting (XSS)
CWE
CWE-79
CVSS
7.1 (high)

Miscellaneous

Original Researcher
Dimas Maulana
Verified
No
WPVDB ID
beb32afc-4bbc-4b19-bbd8-848773adce98

Timeline

Publicly Published
2024-01-16 (about 2 years ago)
Added
2024-01-19 (about 2 years ago)
Last Updated
2025-11-24 (about 3 months ago)

Other

Published
Title
Published
2021-12-01
Title
Booster for WooCommerce < 5.4.9 - Reflected Cross-Site Scripting in Product XML Feeds Module
Published
2024-02-09
Title
Before After Image Slider WP <= 2.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via shortcode
Published
2024-03-07
Title
Premium Addons PRO < 2.9.13 - Authenticated (Contributor+) Stored Cross-Site Scripting via Messenger Chat Widget
Published
2024-11-27
Title
Awesome Event Booking < 2.7.2 - Reflected Cross-Site Scripting
Published
2024-02-21
Title
Elementor Addon Elements < 1.13 - Contributor+ Stored XSS