CVE-2019-10864 - The WP Statistics plugin through 12.6.2 for WordPress has XSS, allowing a remote attacker to inject arbitrary web script or HTML via the Referer header of a GET request

Back Back to CVE browser

MEDIUM

The WP Statistics plugin through 12.6.2 for WordPress has XSS, allowing a remote attacker to inject arbitrary web script or HTML via the Referer header of a GET request

Published Apr 23, 2019

6.1

MEDIUM

CVSS 3.0

EPSS 1.39%

Description

The WP Statistics plugin through 12.6.2 for WordPress has XSS, allowing a remote attacker to inject arbitrary web script or HTML via the Referer header of a GET request.

Affected products

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-79

Cross-site Scripting (XSS)

References (3)

https://euvd.enisa.europa.eu/vulnerability/EUVD-2019-2590
Advisory
https://github.com/wp-statistics/wp-statistics/commit/5aec0a08680f0afea387267a8d1b9fbb3379247c
x_refsource_CONFIRMPatchThird Party Advisory
https://medium.com/%40aramburu/cve-2019-10864-wordpress-7aebc24751c4
x_refsource_MISC

Link	Providers	Tags
https://euvd.enisa.europa.eu/vulnerability/EUVD-2019-2590		Advisory
https://github.com/wp-statistics/wp-statistics/commit/5aec0a08680f0afea387267a8d1b9fbb3379247c		x_refsource_CONFIRMPatchThird Party Advisory
https://medium.com/%40aramburu/cve-2019-10864-wordpress-7aebc24751c4		x_refsource_MISC