CVE-2022-4230: The WP Statistics WordPress plugin before 13.2.9 does not escape a parameter, which could allow authenticated users to perform SQL Injection attacks. By…

PriorityP264high8.8CVSS 3.1

AVNACLPRLUINSUCHIHAH

EPSS

34.27%

98.2th percentile

The WP Statistics WordPress plugin before 13.2.9 does not escape a parameter, which could allow authenticated users to perform SQL Injection attacks. By default, the affected feature is available to users with the manage_options capability (admin+), however the plugin has a settings to allow low privilege users to access it as well.

Affected

1 ranges

Vendor	Product	Version range	Fixed in
veronalabs	wp_statistics	< 13.2.9	13.2.9

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.