Medium
CVE-2026-97276
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 44
Reset filters
Medium
CVE-2026-97652
WP Statistics <= 14.16.14 - Reflected Cross-Site Scripting via REQUEST_URI Query-Parameter Key
High
CVE-2026-93770
WP Statistics – Simple, privacy-friendly Google Analytics alternative <= 14.16.13 - Unauthenticated Stored Cross-Site Scripting
High
CVE-2026-84774
WP Statistics – Simple, privacy-friendly Google Analytics alternative <= 14.16.11 - Unauthenticated Stored Cross-Site Scripting
High
CVE-2026-15780
WP Statistics <= 14.16.8 - Unauthenticated Stored Cross-Site Scripting via 'utm_campaign' Parameter
Medium
CVE-2026-16562
Statistics <= 14.16.9 - Authenticated (Subscriber+) Information Exposure
High
CVE-2026-48839
WP Statistics – Simple, privacy-friendly Google Analytics alternative <= 14.16.6 - Unauthenticated Stored Cross-Site Scripting
Medium
CVE-2026-3488
WP Statistics <= 14.16.4 - Missing Authorization to Authenticated (Subscriber+) Sensitive Information Exposure and Privacy Audit Manipulation
High
CVE-2026-5231
WP Statistics <= 14.16.4 - Unauthenticated Stored Cross-Site Scripting via 'utm_source' Parameter
High
CVE-2025-9816
WP Statistics <= 14.15.4 - Unauthenticated Stored Cross-Site Scripting via User-Agent Header
Medium
CVE-2025-55716
WP Statistics <= 14.15 - Missing Authorization
Medium
CVE-2025-3953
WP Statistics – The Most Popular Privacy-Friendly Analytics Plugin <= 14.13.3 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Plugin Settings Update
High
CVE-2024-2194
WP Statistics <= 14.5 - Unauthenticated Stored Cross-Site Scripting
High
CVE-2023-0955
WP Statistics <= 13.2.16 - Authenticated (Admin+) SQL Injection
High
CVE-2022-38074
WP Statistics <= 13.2.10 - Authenticated (Subscriber+) SQL Injection
High
CVE-2022-4230
WP Statistics <= 13.2.8 - Authenticated (Admin+) SQL Injection
High
42f54887-ce98-4360-8d07-37b1a48fc3fd
WP Statistics <= 13.2.5 - Authenticated (Subscriber+) SQL Injection
Medium
7a0c6425-866d-4b50-b464-87a8173c4abd
WP Statistics <= 13.2.5 - Information Disclosure
Medium
CVE-2022-27231
WP Statistics <= 13.1.7 - Cross-Site Scripting
Medium
CVE-2022-1005
WP Statistics <= 13.2.1 - Reflected Cross-Site Scripting
High
CVE-2022-25307
WP Statistics <= 13.1.5 - Unauthenticated Stored Cross-Site Scripting via platform
High
CVE-2022-25306
WP Statistics <= 13.1.5 - Unauthenticated Stored Cross-Site Scripting via browser
Critical
CVE-2022-25149
WP Statistics <= 13.1.5 - Unauthenticated Blind SQL Injection via IP
High
CVE-2022-25305
WP Statistics <= 13.1.5 - Unauthenticated Stored Cross-Site Scripting via IP
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.