What’s Vulnerable › Vulnerabilities

CVE-2022-27231

• Severity: medium (CVSS 6.1 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 1.0% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2022-06-13 · updated 2026-06-17
• Weakness: CWE-79

Description

Cross-site scripting vulnerability exists in WP Statistics versions prior to 13.2.0 because it improperly processes a platform parameter. By exploiting this vulnerability, an arbitrary script may be executed on the web browser of the user who is logging in to the website using the product.

Affected products

• WP Statistics: before 13.2.0 — fixed in 13.2.0

How to fix

Upgrade to a fixed version: WP Statistics 13.2.0. Check the vendor advisory for mitigations.

References

• https://jvn.jp/en/jp/JVN15241647/index.html
• https://wordpress.org/plugins/wp-statistics/
• https://wordpress.org/plugins/wp-statistics/#developers
• https://jvn.jp/en/jp/JVN15241647/index.html
• https://wordpress.org/plugins/wp-statistics/
• https://wordpress.org/plugins/wp-statistics/#developers

Get alerted when CVE-2022-27231 or the next vulnerability affects your stack