Search

Find a vulnerability

Search criteria ⓘ Use this form to refine search results.
Full-text search supports keyword queries with ranking and filtering.
You can combine vendor, product, and sources to narrow results.
Enable “Apply ordering” to sort by date instead of relevance.

    2 vulnerabilities by wp-stats_project

    CVE-2015-10001 (GCVE-0-2015-10001)

    Vulnerability from cvelistv5 – Published: 2021-11-01 08:45 – Updated: 2024-08-06 08:58
    VLAI
    Title
    WP-Stats < 2.5.2 - CSRF to Stored Cross-Site Scripting (XSS)
    Summary
    The WP-Stats WordPress plugin before 2.52 does not have CSRF check when saving its settings, and did not escape some of them when outputting them, allowing attacker to make logged in high privilege users change them and set Cross-Site Scripting payloads
    Severity
    No CVSS data available.
    CWE
    • CWE-352 - Cross-Site Request Forgery (CSRF)
    Assigner
    References
    Impacted products
    Vendor Product Version
    Unknown WP-Stats Affected: 2.52 , < 2.52 (custom)
    		Create a notification for this product.
    Credits
    Sebastian Wolfgang Kraemer
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-06T08:58:24.557Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://wpscan.com/vulnerability/f5c3dfea-7203-4a98-88ff-aa6a24d03734"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://www.openwall.com/lists/oss-security/2015/06/17/6"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "WP-Stats",
          "vendor": "Unknown",
          "versions": [
            {
              "lessThan": "2.52",
              "status": "affected",
              "version": "2.52",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "value": "Sebastian Wolfgang Kraemer"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The WP-Stats WordPress plugin before 2.52 does not have CSRF check when saving its settings, and did not escape some of them when outputting them, allowing attacker to make logged in high privilege users change them and set Cross-Site Scripting payloads"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-352",
              "description": "CWE-352 Cross-Site Request Forgery (CSRF)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2021-11-01T08:45:47.000Z",
        "orgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81",
        "shortName": "WPScan"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://wpscan.com/vulnerability/f5c3dfea-7203-4a98-88ff-aa6a24d03734"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://www.openwall.com/lists/oss-security/2015/06/17/6"
        }
      ],
      "source": {
        "discovery": "EXTERNAL"
      },
      "title": "WP-Stats \u003c 2.5.2 - CSRF to Stored Cross-Site Scripting (XSS)",
      "x_generator": "WPScan CVE Generator",
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "contact@wpscan.com",
          "ID": "CVE-2015-10001",
          "STATE": "PUBLIC",
          "TITLE": "WP-Stats \u003c 2.5.2 - CSRF to Stored Cross-Site Scripting (XSS)"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "WP-Stats",
                      "version": {
                        "version_data": [
                          {
                            "version_affected": "\u003c",
                            "version_name": "2.52",
                            "version_value": "2.52"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "Unknown"
              }
            ]
          }
        },
        "credit": [
          {
            "lang": "eng",
            "value": "Sebastian Wolfgang Kraemer"
          }
        ],
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "The WP-Stats WordPress plugin before 2.52 does not have CSRF check when saving its settings, and did not escape some of them when outputting them, allowing attacker to make logged in high privilege users change them and set Cross-Site Scripting payloads"
            }
          ]
        },
        "generator": "WPScan CVE Generator",
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "CWE-352 Cross-Site Request Forgery (CSRF)"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://wpscan.com/vulnerability/f5c3dfea-7203-4a98-88ff-aa6a24d03734",
              "refsource": "MISC",
              "url": "https://wpscan.com/vulnerability/f5c3dfea-7203-4a98-88ff-aa6a24d03734"
            },
            {
              "name": "https://www.openwall.com/lists/oss-security/2015/06/17/6",
              "refsource": "MISC",
              "url": "https://www.openwall.com/lists/oss-security/2015/06/17/6"
            }
          ]
        },
        "source": {
          "discovery": "EXTERNAL"
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81",
    "assignerShortName": "WPScan",
    "cveId": "CVE-2015-10001",
    "datePublished": "2021-11-01T08:45:47.000Z",
    "dateReserved": "2021-10-31T00:00:00.000Z",
    "dateUpdated": "2024-08-06T08:58:24.557Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

    CVE-2015-10001 (GCVE-0-2015-10001)

    Vulnerability from nvd – Published: 2021-11-01 08:45 – Updated: 2024-08-06 08:58
    VLAI
    Title
    WP-Stats < 2.5.2 - CSRF to Stored Cross-Site Scripting (XSS)
    Summary
    The WP-Stats WordPress plugin before 2.52 does not have CSRF check when saving its settings, and did not escape some of them when outputting them, allowing attacker to make logged in high privilege users change them and set Cross-Site Scripting payloads
    Severity
    No CVSS data available.
    CWE
    • CWE-352 - Cross-Site Request Forgery (CSRF)
    Assigner
    References
    Impacted products
    Vendor Product Version
    Unknown WP-Stats Affected: 2.52 , < 2.52 (custom)
    		Create a notification for this product.
    Credits
    Sebastian Wolfgang Kraemer
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-06T08:58:24.557Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://wpscan.com/vulnerability/f5c3dfea-7203-4a98-88ff-aa6a24d03734"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://www.openwall.com/lists/oss-security/2015/06/17/6"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "WP-Stats",
          "vendor": "Unknown",
          "versions": [
            {
              "lessThan": "2.52",
              "status": "affected",
              "version": "2.52",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "value": "Sebastian Wolfgang Kraemer"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The WP-Stats WordPress plugin before 2.52 does not have CSRF check when saving its settings, and did not escape some of them when outputting them, allowing attacker to make logged in high privilege users change them and set Cross-Site Scripting payloads"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-352",
              "description": "CWE-352 Cross-Site Request Forgery (CSRF)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2021-11-01T08:45:47.000Z",
        "orgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81",
        "shortName": "WPScan"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://wpscan.com/vulnerability/f5c3dfea-7203-4a98-88ff-aa6a24d03734"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://www.openwall.com/lists/oss-security/2015/06/17/6"
        }
      ],
      "source": {
        "discovery": "EXTERNAL"
      },
      "title": "WP-Stats \u003c 2.5.2 - CSRF to Stored Cross-Site Scripting (XSS)",
      "x_generator": "WPScan CVE Generator",
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "contact@wpscan.com",
          "ID": "CVE-2015-10001",
          "STATE": "PUBLIC",
          "TITLE": "WP-Stats \u003c 2.5.2 - CSRF to Stored Cross-Site Scripting (XSS)"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "WP-Stats",
                      "version": {
                        "version_data": [
                          {
                            "version_affected": "\u003c",
                            "version_name": "2.52",
                            "version_value": "2.52"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "Unknown"
              }
            ]
          }
        },
        "credit": [
          {
            "lang": "eng",
            "value": "Sebastian Wolfgang Kraemer"
          }
        ],
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "The WP-Stats WordPress plugin before 2.52 does not have CSRF check when saving its settings, and did not escape some of them when outputting them, allowing attacker to make logged in high privilege users change them and set Cross-Site Scripting payloads"
            }
          ]
        },
        "generator": "WPScan CVE Generator",
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "CWE-352 Cross-Site Request Forgery (CSRF)"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://wpscan.com/vulnerability/f5c3dfea-7203-4a98-88ff-aa6a24d03734",
              "refsource": "MISC",
              "url": "https://wpscan.com/vulnerability/f5c3dfea-7203-4a98-88ff-aa6a24d03734"
            },
            {
              "name": "https://www.openwall.com/lists/oss-security/2015/06/17/6",
              "refsource": "MISC",
              "url": "https://www.openwall.com/lists/oss-security/2015/06/17/6"
            }
          ]
        },
        "source": {
          "discovery": "EXTERNAL"
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81",
    "assignerShortName": "WPScan",
    "cveId": "CVE-2015-10001",
    "datePublished": "2021-11-01T08:45:47.000Z",
    "dateReserved": "2021-10-31T00:00:00.000Z",
    "dateUpdated": "2024-08-06T08:58:24.557Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}