CVEvulnerability
CVE-2015-10001
4.3 MEDIUM
Official page ↗
- Status
- Modified
- Published
- 2021-11-01
- Last modified
- 2026-06-17
- Assigner
- [email protected]
- CVSS 3.1 ([email protected])
- 4.3 MEDIUM — CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
- CVSS 2.0 ([email protected])
- 4.3 MEDIUM — AV:N/AC:M/Au:N/C:N/I:P/A:N
- Weaknesses
- CWE-352
Description
The WP-Stats WordPress plugin before 2.52 does not have CSRF check when saving its settings, and did not escape some of them when outputting them, allowing attacker to make logged in high privilege users change them and set Cross-Site Scripting payloads
Affected configurations
• wp-stats project wp-stats (< 2.52)
Related
Weakness · CWE (1)
- CWE-352 Cross-Site Request Forgery weakness
References
- https://wpscan.com/vulnerability/f5c3dfea-7203-4a98-88ff-aa6a24d03734 Third Party Advisory
- https://www.openwall.com/lists/oss-security/2015/06/17/6 Exploit, Mailing List, Third Party Advisory
- https://wpscan.com/vulnerability/f5c3dfea-7203-4a98-88ff-aa6a24d03734 Third Party Advisory
- https://www.openwall.com/lists/oss-security/2015/06/17/6 Exploit, Mailing List, Third Party Advisory