CVE-2022-1005 WP Statistics < 13.2.2 - Reflected Cross-Site Scripting

2022-06-0608:50:53

CWE-79

WPScan

www.cve.org

cve-2022-1005

wp statistics

xss

cross-site scripting

wordpress

EPSS

0.001

Percentile

34.0%

JSON

The WP Statistics WordPress plugin before 13.2.2 does not sanitise the REQUEST_URI parameter before outputting it back in the rendered page, leading to Cross-Site Scripting (XSS) in web browsers which do not encode characters

CNA Affected

[
  {
    "product": "WP Statistics",
    "vendor": "Unknown",
    "versions": [
      {
        "lessThan": "13.2.2",
        "status": "affected",
        "version": "13.2.2",
        "versionType": "custom"
      }
    ]
  }
]