The WP Statistics WordPress plugin before 14.0 does not escape a parameter, which could allow authenticated users to perform SQL Injection attacks. By default, the affected feature is available to users with the manage_options capability (admin+), however the plugin has a settings to allow low privilege users to access it as well.
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Wp Statistics Plugin | — | Update wp-statistics plugin to version 14.0, or a newer patched version | May 15, 2025 | Mar 6, 2023 |
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub