Advisories · Technology
veronalabs WP Statistics – Simple, privacy-friendly Google Analytics alternative.
Every CVE that names veronalabs WP Statistics – Simple, privacy-friendly Google Analytics alternative among its affected products, newest first. Vendors and products are as the CNA wrote them; check the affected versions on each record.
- CVSS 6.1 Medium
WP Statistics <= 14.16.14 - Reflected Cross-Site Scripting via REQUEST_URI Query-Parameter Key
- veronalabs WP Statistics – Simple, privacy-friendly Google Analytics alternative
- Cross-site scripting (XSS)
- CVSS 7.2 High
WP Statistics <= 14.16.8 - Unauthenticated Stored Cross-Site Scripting via 'utm_campaign' Parameter
- veronalabs WP Statistics – Simple, privacy-friendly Google Analytics alternative
- Cross-site scripting (XSS)
- CVSS 6.5 Medium
WP Statistics <= 14.16.4 - Missing Authorization to Authenticated (Subscriber+) Sensitive Information Exposure and Privacy Audit Manipulation
- veronalabs WP Statistics – Simple, privacy-friendly Google Analytics alternative
- Broken access control
- CVSS 7.2 High
WP Statistics <= 14.16.4 - Unauthenticated Stored Cross-Site Scripting via 'utm_source' Parameter
- veronalabs WP Statistics – Simple, privacy-friendly Google Analytics alternative
- Cross-site scripting (XSS)
- CVSS 7.2 HighCritical · CVSS 7+ and EPSS
WP Statistics <= 14.5.4 - Unauthenticated Stored Cross-Site Scripting via User-Agent Header
- veronalabs WP Statistics – Simple, privacy-friendly Google Analytics alternative
- Cross-site scripting (XSS)
- CVSS 5.4 Medium
WP Statistics – The Most Popular Privacy-Friendly Analytics Plugin <= 14.13.3 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Plugin Settings Update
- veronalabs WP Statistics – Simple, privacy-friendly Google Analytics alternative
- Broken access control
- CVSS 7.2 HighCritical · CVSS 7+ and EPSS
WP Statistics <= 14.5 - Unauthenticated Stored Cross-Site Scripting
- veronalabs WP Statistics – Simple, privacy-friendly Google Analytics alternative
- Cross-site scripting (XSS)
- CVSS 6.5 Medium
WP Statistics <= 13.1.1 - Cross-Site Request Forgery to Arbitrary Plugin Activation and Deactivation
- veronalabs WP Statistics – Simple, privacy-friendly Google Analytics alternative
- Cross-site request forgery (CSRF)