Wp Server Stats Vulnerabilities

Several plugins for WordPress hosted on WordPress.org have been compromised and injected with malicious PHP scripts. A malicious threat actor compromised the source code of various plugins and injected code that exfiltrates database credentials and is used to create new, malicious, administrator users and send that dat...

CVSS:

10

Affected:

1.7.6 – 1.7.6

Fixed in:

1.7.8

Disclosed:

Jun 24, 2024

CVE-2024-6297 on NVD →

The WP Server Health Stats plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.7.3. This is due to missing or incorrect nonce validation on the wpss_cache_purge_callback() function. This makes it possible for unauthenticated attackers to trigger the purge callback via a...

CVSS:

4.3

Affected:

up to 1.7.3

Fixed in:

1.7.4

Disclosed:

Apr 5, 2024

CVE-2024-31250 on NVD →

The WP Server Health Stats plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘API Pro Key’ parameter in versions up to, and including, 1.6.10 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and a...

CVSS:

5.5

Affected:

up to 1.6.10

Fixed in:

1.7.0

Disclosed:

Aug 18, 2022

CVE-2022-2887 on NVD →