Veronalabs vulnerabilities, page 2
59 vulnerabilities
Known vulnerabilities in Veronalabs products, newest first, with CVSS severity, EPSS, KEV listings and ransomware use, across 6 products.
CVE-2022-25306veronalabswp_statistics+2
EPSS score1.38%
The WP Statistics WordPress plugin is vulnerable to Cross-Site Scripting due to insufficient escaping and sanitization of the browser parameter found in the ~/includes/class-wp-statistics-visitor.php file which allows attackers to inject arbitrary web scripts onto several pages that execute when site administrators view a sites statistics, in versions up to and including 13.1.5.CVE-2022-25149veronalabswp_statistics+2EPSS score77.46%
The WP Statistics WordPress plugin is vulnerable to SQL Injection due to insufficient escaping and parameterization of the IP parameter found in the ~/includes/class-wp-statistics-hits.php file which allows attackers without authentication to inject arbitrary SQL queries to obtain sensitive information, in versions up to and including 13.1.5.CVE-2022-27231veronalabswp_statistics+1EPSS score1.03%
Cross-site scripting vulnerability exists in WP Statistics versions prior to 13.2.0 because it improperly processes a platform parameter. By exploiting this vulnerability, an arbitrary script may be executed on the web browser of the user who is logging in to the website using the product.CVE-2022-38074veronalabswp_statistics+1EPSS score0.73%
SQL Injection vulnerability in VeronaLabs WP Statistics plugin <= 13.2.10 versions.CVE-2017-18515veronalabswp_statistics+1EPSS score2.53%
The wp-statistics plugin before 12.0.8 for WordPress has SQL injection.CVE-2024-2194veronalabswp statistics – simple, privacy-friendly google analytics alternative+1EPSS score67.72%
The WP Statistics plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the URL search parameter in all versions up to, and including, 14.5 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.CVE-2024-1073veronalabsslimstat analytics+2EPSS score0.45%
The SlimStat Analytics plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'filter_array' parameter in all versions up to, and including, 5.1.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.CVE-2024-9548veronalabsslimstat analytics+2EPSS score0.54%
The SlimStat Analytics plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the resource parameter in all versions up to, and including, 5.2.6 due to insufficient input sanitization and output escaping when logging visitor requests. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.CVE-2024-25920veronalabswp_sms+1EPSS score0.32%
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in VeronaLabs WP SMS allows Stored XSS.This issue affects WP SMS: from n/a through 6.3.4.CVE-2024-43331veronalabswp_sms+1EPSS score0.36%
Missing Authorization vulnerability in VeronaLabs WP SMS.This issue affects WP SMS: from n/a through 6.9.3.CVE-2024-24881veronalabswp_sms+2EPSS score0.38%
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in VeronaLabs WP SMS – Messaging & SMS Notification for WordPress, WooCommerce, GravityForms, etc allows Reflected XSS.This issue affects WP SMS – Messaging & SMS Notification for WordPress, WooCommerce, GravityForms, etc: from n/a through 6.5.2.CVE-2024-30454veronalabswp_sms+1EPSS score0.24%
Cross-Site Request Forgery (CSRF) vulnerability in VeronaLabs WP SMS.This issue affects WP SMS: from n/a through 6.6.2.CVE-2024-34811veronalabswp_sms+1EPSS score0.42%
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in VeronaLabs WP SMS allows Stored XSS.This issue affects WP SMS: from n/a through 6.5.1.CVE-2019-13275veronalabswp_statistics+1EPSS score2.60%
An issue was discovered in the VeronaLabs wp-statistics plugin before 12.6.7 for WordPress. The v1/hit endpoint of the API, when the non-default "use cache plugin" setting is enabled, is vulnerable to unauthenticated blind SQL Injection.CVE-2019-10864veronalabswp_statistics+1EPSS score1.39%
The WP Statistics plugin through 12.6.2 for WordPress has XSS, allowing a remote attacker to inject arbitrary web script or HTML via the Referer header of a GET request.CVE-2019-12566veronalabswp_statistics+1EPSS score1.09%
The WP Statistics plugin through 12.6.5 for Wordpress has stored XSS in includes/class-wp-statistics-pages.php. This is related to an account with the Editor role creating a post with a title that contains JavaScript, to attack an admin user.CVE-2026-54818veronalabsslimstat analytics+1EPSS score0.36%
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in VeronaLabs Slimstat Analytics allows Blind SQL Injection.
This issue affects Slimstat Analytics: from n/a through 5.4.11.CVE-2026-40790veronalabswp_sms+1EPSS score0.34%
Subscriber Sensitive Data Exposure in WP SMS <= 7.2.1 versions.CVE-2026-84774veronalabswp_statistics+1EPSS score0.25%
Unauthenticated Cross Site Scripting (XSS) in WP Statistics <= 14.16.11 versions.CVE-2026-1238veronalabsslimstat analytics+1EPSS score0.33%
The SlimStat Analytics plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'fh' (fingerprint) parameter in all versions up to, and including, 5.3.5 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.