CVE-2022-33965

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

Multiple Unauthenticated SQL Injection (SQLi) vulnerabilities in Osamaesh WP Visitor Statistics plugin <= 5.7 at WordPress.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-89

Affected software

Vendor	Product	Versions
Osamaesh	WP Visitor Statistics (WordPress plugin)	>= <= 5.7, <= 5.7

References

https://patchstack.com/database/vulnerability/wp-stats-manager/wordpress-wp-visitor-statistics-plugin-5-7-multiple-unauthenticated-sql-injection-sqli-vulnerabilitiesPatch, Third Party Advisory
https://wordpress.org/plugins/wp-stats-manager/#developersRelease Notes, Third Party Advisory
https://patchstack.com/database/vulnerability/wp-stats-manager/wordpress-wp-visitor-statistics-plugin-5-7-multiple-unauthenticated-sql-injection-sqli-vulnerabilitiesPatch, Third Party Advisory
https://wordpress.org/plugins/wp-stats-manager/#developersRelease Notes, Third Party Advisory

Timeline

Published: Jul 25, 2022
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2022

CVE-2022-339677.8squashfs filesystem implementation of U-Boot versions from v2020.10-rc2 to v2022.07-rc5 contains a heap-based buffer overflow vulnerability CVE-2022-339684.9In BIG-IP Versions 17.0.x before 17.0.0.1, 16.1.x before 16.1.3.1, 15.1.x before 15.1.6.1, 14.1.x before 14.1.5.1, and all versions of 13.1.CVE-2022-339697.2Authenticated WordPress Options Change vulnerability in Biplob Adhikari's Flipbox plugin <= 2.6.0 at WordPress.CVE-2022-33979.8OMRON CX-Programmer 9.78 and prior is vulnerable to an Out-of-Bounds Write, which may allow an attacker to execute arbitrary code.CVE-2022-339707.2Authenticated WordPress Options Change vulnerability in Biplob018 Shortcode Addons plugin <= 3.1.2 at WordPress.CVE-2022-339717.5Authentication bypass by capture-replay vulnerability exists in Machine automation controller NX7 series all models V1.28 and earlier, Machi CVE-2022-339724.4Incorrect calculation in microcode keying mechanism for some 3rd Generation Intel(R) Xeon(R) Scalable Processors may allow a privileged user CVE-2022-339733.3Improper access control in the Intel(R) WAPI Security software for Windows 10/11 before version 22.2150.0.1 may allow an authenticated user CVE-2022-339748.8Cross-Site Request Forgery (CSRF) vulnerability in Smash Balloon Custom Twitter Feeds (Tweets Widget) plugin <= 1.8.4 versions.CVE-2022-339777.5untangle is a python library to convert XML data to python objects. untangle versions 1.2.0 and earlier improperly restricts recursive entit CVE-2022-339786.1Reflected Cross-Site Scripting (XSS) vulnerability FontMeister plugin <= 1.08 at WordPress.CVE-2022-33989.8OMRON CX-Programmer 9.78 and prior is vulnerable to an Out-of-Bounds Write, which may allow an attacker to execute arbitrary code.