Addfreestats Vulnerabilities

[en] Missing Authorization vulnerability in AFS Analytics AFS Analytics allows Accessing Functionality Not Properly Constrained by ACLs. This issue affects AFS Analytics: from n/a through 4.21.

Affected:

up to 4.22

Fixed in:

4.22

Disclosed:

Jun 17, 2025

CVE-2025-49864 on NVD →

The AFS Analytics plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on a function in all versions up to, and including, 4.21. This makes it possible for unauthenticated attackers to perform an unauthorized action.

CVSS:

5.3

Affected:

up to 4.21

Fixed in:

4.22

Disclosed:

Jun 12, 2025

CVE-2025-49864 on NVD →

[en] Stored Cross-site Scripting (XSS) vulnerability in AFS Analytics plugin <= 4.18 versions.

Affected:

up to 4.16

Fixed in:

4.16

Disclosed:

Mar 15, 2023

CVE-2022-37402 on NVD →

The AFS Analytics plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 4.15 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pa...

CVSS:

5.5

Affected:

up to 4.15

Fixed in:

4.16

Disclosed:

Oct 31, 2022

CVE-2022-37402 on NVD →