WordPress wp-statistics has 18 known advisories in the phpwarden feed. Feed 2026.10.29.1, updated 2026-10-28.
| CVE | Title | Severity | CVSS | Affected | Fixed in |
|---|---|---|---|---|---|
| CVE-2022-25148 | The WP Statistics WordPress plugin is vulnerable to SQL Injection due to insufficient escaping and parameterization of the current_page_id p | critical | 9.8 | <=13.1.5 | – |
| CVE-2022-25305 | The WP Statistics WordPress plugin is vulnerable to Cross-Site Scripting due to insufficient escaping and sanitization of the IP parameter f | high | 7.2 | <=13.1.5 | – |
| CVE-2022-25149 | The WP Statistics WordPress plugin is vulnerable to SQL Injection due to insufficient escaping and parameterization of the IP parameter foun | critical | 9.8 | <=13.1.5 | – |
| CVE-2022-0513 | The WP Statistics WordPress plugin is vulnerable to SQL Injection due to insufficient escaping and parameterization of the exclusion_reason | critical | 9.8 | <=13.1.4 | – |
| CVE-2022-4230 | The WP Statistics WordPress plugin before 13.2.9 does not escape a parameter, which could allow authenticated users to perform SQL Injection | high | 8.8 | <13.2.9 | 13.2.9 |
| CVE-2022-0651 | The WP Statistics WordPress plugin is vulnerable to SQL Injection due to insufficient escaping and parameterization of the current_page_type | critical | 9.8 | <=13.1.5 | – |
| CVE-2021-24340 | The WP Statistics WordPress plugin before 13.0.8 relied on using the WordPress esc_sql() function on a field not delimited by quotes and did | high | 7.5 | <13.0.8 | 13.0.8 |
| CVE-2019-13275 | An issue was discovered in the VeronaLabs wp-statistics plugin before 12.6.7 for WordPress. The v1/hit endpoint of the API, when the non-def | critical | 9.8 | <=12.6.6 | – |
| CVE-2017-18515 | The wp-statistics plugin before 12.0.8 for WordPress has SQL injection. | critical | 9.8 | <12.0.8 | 12.0.8 |
| CVE-2019-10864 | The WP Statistics plugin through 12.6.2 for WordPress has XSS, allowing a remote attacker to inject arbitrary web script or HTML via the Ref | medium | 6.1 | <=12.6.2 | – |
| CVE-2022-25306 | The WP Statistics WordPress plugin is vulnerable to Cross-Site Scripting due to insufficient escaping and sanitization of the browser parame | high | 7.2 | <=13.1.5 | – |
| CVE-2022-25307 | The WP Statistics WordPress plugin is vulnerable to Cross-Site Scripting due to insufficient escaping and sanitization of the platform param | high | 7.2 | <=13.1.5 | – |
| CVE-2019-12566 | The WP Statistics plugin through 12.6.5 for Wordpress has stored XSS in includes/class-wp-statistics-pages.php. This is related to an accoun | medium | 5.4 | <=12.6.5 | – |
| CVE-2022-1005 | The WP Statistics WordPress plugin before 13.2.2 does not sanitise the REQUEST_URI parameter before outputting it back in the rendered page, | medium | 6.1 | <13.2.2 | 13.2.2 |
| CVE-2023-0955 | The WP Statistics WordPress plugin before 14.0 does not escape a parameter, which could allow authenticated users to perform SQL Injection a | high | 8.8 | <14.0 | 14.0 |
| CVE-2017-10991 | The WP Statistics plugin through 12.0.9 for WordPress has XSS in the rangestart and rangeend parameters on the wps_referrers_page page. | medium | 6.1 | <=12.0.9 | – |
| CVE-2018-1000556 | WordPress version 4.8 + contains a Cross Site Scripting (XSS) vulnerability in plugins.php or core wordpress on delete function that can res | medium | 6.1 | <12.0.6 | 12.0.6 |
| CVE-2021-4333 | The WP Statistics plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 13.1.1. This is due to | medium | 6.5 | <=13.1.1 | – |
Find out in one command. phpwarden checks your WordPress install against this advisory and 20,000+ others, ranked by real-world exploitation (CISA KEV + EPSS). Free, offline, open data.
# one-time install pip install phpwarden # then phpwarden wordpress /var/www/html
Or keep it checked automatically with the GitHub Action or a nightly cron; see WordPress docs.
Install docs How findings are ranked