CVE-2022-27231

MediumCVSS 6.1/10Last modified Jun 17, 2026

Description

Cross-site scripting vulnerability exists in WP Statistics versions prior to 13.2.0 because it improperly processes a platform parameter. By exploiting this vulnerability, an arbitrary script may be executed on the web browser of the user who is logging in to the website using the product.

Metrics

CVSS 3.1 6.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

Vendor	Product	Versions
VeronaLabs	WP Statistics	versions prior to 13.2.0

References

https://jvn.jp/en/jp/JVN15241647/index.htmlRelease Notes, Third Party Advisory
https://wordpress.org/plugins/wp-statistics/Product, Third Party Advisory
https://wordpress.org/plugins/wp-statistics/#developersRelease Notes, Third Party Advisory
https://jvn.jp/en/jp/JVN15241647/index.htmlRelease Notes, Third Party Advisory
https://wordpress.org/plugins/wp-statistics/Product, Third Party Advisory
https://wordpress.org/plugins/wp-statistics/#developersRelease Notes, Third Party Advisory

Timeline

Published: Jun 13, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-272337.5XML injection in the Quartus(R) Prime Programmer included in the Intel(R) Quartus Prime Pro and Standard edition software may allow an unaut CVE-2022-272346.5Server-side request forgery in the CVAT software maintained by Intel(R) before version 2.0.1 may allow an authenticated user to potentially CVE-2022-272358.8Multiple Broken Access Control vulnerabilities in Social Share Buttons by Supsystic plugin <= 2.2.3 at WordPress.CVE-2022-272376.1There is a cross-site scripting (XSS) vulnerability in an NI Web Server component installed with several NI products. Depending on the produ CVE-2022-272385.4BigBlueButton version 2.4.7 (or earlier) is vulnerable to stored Cross-Site Scripting (XSS) in the private chat functionality. A threat acto CVE-2022-272397.8In cifs-utils through 6.14, a stack-based buffer overflow when parsing the mount.cifs ip= command-line argument could lead to local attacker CVE-2022-27249.8A vulnerability was found in SourceCodester Employee Management System. It has been declared as critical. Affected by this vulnerability is CVE-2022-272409.8scheme/webauthn.c in Glewlwyd SSO server 2.x before 2.6.2 has a buffer overflow associated with a webauthn assertion.CVE-2022-272417.5A vulnerability has been identified in Mendix Applications using Mendix 7 (All versions < V7.23.31), Mendix Applications using Mendix 8 (All CVE-2022-272425.5A vulnerability has been identified in OpenV2G (V0.9.4). The OpenV2G EXI parsing feature is missing a length check when parsing X509 serial CVE-2022-272437.8An issue was discovered in MISP before 2.4.156. app/View/Users/terms.ctp allows Local File Inclusion via the custom terms file setting.CVE-2022-272444.8An issue was discovered in MISP before 2.4.156. A malicious site administrator could store an XSS payload in the custom auth name. This woul