plugin

Stats Vulnerabilities

2 known security issues reported for the Stats WordPress plugin. Most recent disclosed Jul 27, 2007.

2 high

Running Stats on your site? Check whether your installed version is affected.

Scan your site free

stats <= 1.1 - SQL Injection

high

The stats plugin for WordPress is vulnerable to SQL Injection via the $post_ids parameter in versions up to, and including, 1.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for attackers to append additional SQL queries...

CVSS:
8.8
Affected:
up to 1.1
Fixed in:
1.1.1
Disclosed:
Jul 27, 2007

stats <= 1.0 - Stored Cross-Site Scripting

high

Cross-site scripting (XSS) vulnerability in the skeltoac stats (Automattic Stats) 1.0 plugin for WordPress allows remote attackers to inject arbitrary web script or HTML via the HTTP Referer field.

CVSS:
7.2
Affected:
up to 1.0
Fixed in:
1.1
Disclosed:
Jun 20, 2007

CVE-2007-3288 on NVD →

Protect your WordPress site

Run a free security scan to detect vulnerable plugins and themes, exposed files, and malware — no plugin install, no signup.

Scan your site free

← Back to the vulnerability database