CVE-2023-0955: The WP Statistics WordPress plugin before 14.0 does not escape a parameter, which could allow authenticated users to perform SQL Injection attacks. By default…

PriorityP347high8.8CVSS 3.1

AVNACLPRLUINSUCHIHAH

EPSS

0.90%

55.1th percentile

The WP Statistics WordPress plugin before 14.0 does not escape a parameter, which could allow authenticated users to perform SQL Injection attacks. By default, the affected feature is available to users with the manage_options capability (admin+), however the plugin has a settings to allow low privilege users to access it as well.

Affected

1 ranges

Vendor	Product	Version range	Fixed in
veronalabs	wp_statistics	< 14.0	14.0

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.