Lucene search
WPScanCVELIST:CVE-2022-4230HistoryJan 23, 2023 - 2:31 p.m.
CVE-2022-4230 WP Statistics < 13.2.9 - Authenticated SQLi
2023-01-2314:31:43
WPScan
www.cve.org
1
wordpress
plugin
sql injection
authenticated user
manage options
EPSS
0.001
Percentile
38.3%
The WP Statistics WordPress plugin before 13.2.9 does not escape a parameter, which could allow authenticated users to perform SQL Injection attacks. By default, the affected feature is available to users with the manage_options capability (admin+), however the plugin has a settings to allow low privilege users to access it as well.
CNA Affected
[
{
"vendor": "Unknown",
"product": "WP Statistics",
"versions": [
{
"status": "affected",
"versionType": "custom",
"version": "0",
"lessThan": "13.2.9"
}
],
"defaultStatus": "unaffected",
"collectionURL": "https://wordpress.org/plugins"
}
]Related
nvd
nvd
CVE-2022-4230
2023-01-23 15:15:14
cve
cve
CVE-2022-4230
2023-01-23 15:15:14
osv
osv
CVE-2022-4230
2023-01-23 15:15:14
openvas
openvas
WordPress WP Statistics Plugin < 13.2.9 SQLi Vulnerability
2023-01-24 00:00:00
wpexploit
wpexploit
WP Statistics < 13.2.9 - Authenticated SQLi
2022-12-27 00:00:00
prion
prion
Sql injection
2023-01-23 15:15:00
wpvulndb
wpvulndb
WP Statistics < 13.2.9 - Authenticated SQLi
2022-12-27 00:00:00