CVE-2015-10001
Medium
Description
The WP-Stats WordPress plugin before 2.52 does not have CSRF check when saving its settings, and did not escape some of them when outputting them, allowing attacker to make logged in high privilege users change them and set Cross-Site Scripting payloads
SeverityMedium
CVSS4.3
Exploit probability—
ProductWp-stats
PublishedNov 1, 2021
First seenNov 1, 2021
Weakness typeCWE-352Cross-site request forgery (CSRF)
How to fix
Update
- wp-stats_project wp-stats2.52 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| wp-stats_project wp-stats | v < 2.52 | 2.52 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.