WP Statistics <= 13.1.5 Unauthenticated Stored Cross-Site Scripting via platform

Description

The WP Statistics WordPress plugin is vulnerable to Cross-Site Scripting due to insufficient escaping and sanitization of the platform parameter found in the ~/includes/class-wp-statistics-hits.php file which allows attackers to inject arbitrary web scripts onto several pages that execute when site administrators view a sites statistics, in versions up to and including 13.1.5.

Scores

EPSS (exploitation in 30 days)

1.4% · top 28% of all CVEs (5 Nov 2026)

CISA SSVC

Exploitation: none · Automatable: yes · Technical impact: partial

The list uses the assigner's score when there is one, then CISA's, then NVD's: High 7.2.

Weakness

• CWE-79 Cross-site Scripting (XSS) (opens in a new tab)All about CWE-79 and its CVEs

Affected products

• WP Statistics · WP Statistics

  • affected 13.1.5 – ≤ 13.1.5

What to do

Solution: Update to version 13.1.6 or newer.

References (3)

• https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=2679983%40wp-statistics&new=2679983%40wp-statistics&sfp_email=&sfph_mail= (opens in a new tab)x_refsource_MISCx_transferred
• https://gist.github.com/Xib3rR4dAr/8090a6d026d4601083cff80aa80de7eb (opens in a new tab)x_refsource_MISCx_transferred
• https://www.wordfence.com/vulnerability-advisories/#CVE-2022-25307 (opens in a new tab)x_refsource_MISCx_transferred

Sources

The same CVE in the primary databases and aggregators, to check against.

• CVE.org record (opens in a new tab)
• CVE List JSON (GitHub) (opens in a new tab)
• NVD (opens in a new tab)
• FIRST EPSS (opens in a new tab)
• OSV.dev (opens in a new tab)
• GitHub Advisories (opens in a new tab)
• CIRCL Vulnerability-Lookup (opens in a new tab)

Badge for a README or a ticket

[![CVE-2022-25307](https://trackcve.app/badge/CVE-2022-25307.svg)](https://trackcve.app/cve/CVE-2022-25307)

Record last updated 7 Feb 2025, 20:49 UTC.