WP Statistics vulnerabilities

The WP Statistics plugin in versions <= 14.16.13 is vulnerable to unauthenticated Cross Site Scripting (XSS). An unauthenticated attacker can inject malicious script.

The WP Statistics plugin up to version 14.16.14 contains a reflected XSS vulnerability. An attacker can inject a malicious script that executes in the victim's browser.

The WP Statistics plugin for WordPress up to version 14.16.14 is vulnerable to Reflected Cross-Site Scripting via the REQUEST_URI query parameter key. Insufficient input sanitization and output escaping allow unauthenticated attackers to inject scripts.

The WP Statistics plugin version 14.16.11 and earlier contains an unauthenticated Cross-Site Scripting (XSS) vulnerability.

The WP Statistics plugin for WordPress up to version 14.16.8 is vulnerable to Stored Cross-Site Scripting via the 'utm_campaign' parameter due to insufficient input sanitization and output escaping. Unauthenticated attackers can inject arbitrary web scripts that execute when a user accesses an injected page. The attack can be performed without authentication via the public /wp-statistics/v2/hit REST endpoint.

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in VeronaLabs WP Statistics allows DOM-Based XSS. This issue affects WP Statistics: from n/a through 14.16.6.