CVE-2015-10001

MediumCVSS 4.3/10Last modified Jun 17, 2026

Description

The WP-Stats WordPress plugin before 2.52 does not have CSRF check when saving its settings, and did not escape some of them when outputting them, allowing attacker to make logged in high privilege users change them and set Cross-Site Scripting payloads

Metrics

CVSS 3.1 4.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

Weakness enumeration

CWE-352

Affected software

No affected versions have been published.

Timeline

Published: Nov 1, 2021
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2015

CVE-2015-100025.5A vulnerability classified as problematic has been found in Kiddoware Kids Place. This affects the Home Button Protection. A repeated pressi CVE-2015-100034.3A vulnerability, which was classified as problematic, was found in FileZilla Server up to 0.9.50. This affects an unknown part of the compon CVE-2015-100047.5Token validation methods are susceptible to a timing side-channel during HMAC comparison. With a large enough number of requests over a low CVE-2015-100057.5A vulnerability was found in markdown-it up to 2.x. It has been classified as problematic. Affected is an unknown function of the file lib/c CVE-2015-100066.1A vulnerability, which was classified as problematic, has been found in admont28 Ingnovarq. Affected by this issue is some unknown functiona CVE-2015-100076.1** UNSUPPORTED WHEN ASSIGNED ** A vulnerability was found in 82Flex WEIPDCRM and classified as problematic. Affected by this issue is some u CVE-2015-100089.8** UNSUPPORTED WHEN ASSIGNED ** A vulnerability was found in 82Flex WEIPDCRM. It has been classified as critical. This affects an unknown pa CVE-2015-100099.8A vulnerability was found in nterchange up to 4.1.0. It has been rated as critical. This issue affects the function getContent of the file a CVE-2015-100110.0Multiple stack-based buffer overflows in IniNet embeddedWebServer (aka eWebServer) before 2.02 allow remote attackers to execute arbitrary c CVE-2015-100106.1A vulnerability was found in OpenDNS OpenResolve. It has been rated as problematic. Affected by this issue is the function get of the file r CVE-2015-100119.8A vulnerability classified as problematic has been found in OpenDNS OpenResolve. This affects an unknown part of the file resolverapi/endpoi CVE-2015-100127.5** UNSUPPORTED WHEN ASSIGNED ** A vulnerability was found in sumocoders FrameworkUserBundle up to 1.3.x. It has been rated as problematic. A