VeronaLabs

19 results · Clear filters · Feed

• High 7.1
  CVE-2026-97276

  WordPress WP Statistics plugin <= 14.16.14 - Cross Site Scripting (XSS) vulnerability

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in VeronaLabs WP Statistics wp-statistics allows Reflected XSS.This issue affects WP Statistics: from n/a through 14.16.14.

  VeronaLabs WP Statistics
  Oct 4, 2026
• High 7.1
  CVE-2026-93770

  WordPress WP Statistics plugin <= 14.16.13 - Cross Site Scripting (XSS) vulnerability

  Unauthenticated Cross Site Scripting (XSS) in WP Statistics <= 14.16.13 versions.

  VeronaLabs WP Statistics
  Sep 30, 2026
• High 7.2
  CVE-2026-15780

  WP Statistics <= 14.16.8 - Unauthenticated Stored Cross-Site Scripting via 'utm_campaign' Parameter

  The WP Statistics – Simple, privacy-friendly Google Analytics alternative plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'utm_campaign' parameter in all versions up to, and including, 14.16.8 due to insufficient input sanitization a…

  VeronaLabs WP Statistics – Simple, privacy-friendly Google Analytics alternative Web / CMS
  Aug 19, 2026
• High 8.5
  CVE-2026-54818

  WordPress Slimstat Analytics plugin <= 5.4.11 - SQL Injection vulnerability

  Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in VeronaLabs Slimstat Analytics allows Blind SQL Injection. This issue affects Slimstat Analytics: from n/a through 5.4.11.

  VeronaLabs Slimstat Analytics
  Jun 17, 2026
• High 7.1
  CVE-2026-48839

  WordPress WP Statistics plugin <= 14.16.6 - Cross Site Scripting (XSS) vulnerability

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in VeronaLabs WP Statistics allows DOM-Based XSS. This issue affects WP Statistics: from n/a through 14.16.6.

  VeronaLabs WP Statistics
  Jun 1, 2026
• High 7.2
  CVE-2026-7634

  SlimStat Analytics <= 5.4.11 - Unauthenticated Stored Cross-Site Scripting via User-Agent Header

  The SlimStat Analytics plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'User-Agent' header in all versions up to, and including, 5.4.11 due to insufficient input sanitization and output escaping. This makes it possible for unauthenti…

  VeronaLabs Slimstat Analytics Web / CMS
  May 28, 2026
• High 7.2
  CVE-2026-5231

  WP Statistics <= 14.16.4 - Unauthenticated Stored Cross-Site Scripting via 'utm_source' Parameter

  The WP Statistics plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'utm_source' parameter in all versions up to, and including, 14.16.4. This is due to insufficient input sanitization and output escaping. The plugin's referral parser …

  VeronaLabs WP Statistics – Simple, privacy-friendly Google Analytics alternative Web / CMS
  Apr 17, 2026
• High 7.2
  CVE-2026-1238

  SlimStat Analytics <= 5.3.5 - Unauthenticated Stored Cross-Site Scripting via 'fh'

  The SlimStat Analytics plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'fh' (fingerprint) parameter in all versions up to, and including, 5.3.5 due to insufficient input sanitization and output escaping. This makes it possible for un…

  VeronaLabs Slimstat Analytics Web / CMS
  Mar 19, 2026
• High 7.6
  CVE-2026-28136

  WordPress WP SMS plugin <= 6.9.12 - SQL Injection vulnerability

  Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in VeronaLabs WP SMS wp-sms allows SQL Injection.This issue affects WP SMS: from n/a through <= 6.9.12.

  VeronaLabs WP SMS
  Feb 26, 2026
• High 7.1
  CVE-2025-69323

  WordPress Slimstat Analytics plugin <= 5.3.2 - Reflected Cross Site Scripting (XSS) vulnerability

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in VeronaLabs Slimstat Analytics wp-slimstat allows Reflected XSS.This issue affects Slimstat Analytics: from n/a through <= 5.3.2.

  VeronaLabs Slimstat Analytics
  Feb 20, 2026
• High 7.2
  CVE-2025-15055

  SlimStat Analytics <= 5.3.4 - Unauthenticated Stored Cross-Site Scripting via 'notes/resource' Parameters

  The SlimStat Analytics plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'notes' and 'resource' parameters in all versions up to, and including, 5.3.4 due to insufficient input sanitization and output escaping. This makes it possible f…

  VeronaLabs Slimstat Analytics Web / CMS
  Jan 9, 2026
• High 7.2
  CVE-2025-15057

  SlimStat Analytics <= 5.3.3 - Unauthenticated Stored Cross-Site Scripting via 'fh' Parameter

  The SlimStat Analytics plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the `fh` (fingerprint) parameter in all versions up to, and including, 5.3.3. This is due to insufficient input sanitization and output escaping on the fingerprint va…

  VeronaLabs Slimstat Analytics Web / CMS
  Jan 9, 2026
• High 7.2
  CVE-2025-14151

  SlimStat Analytics <= 5.3.2 - Unauthenticated Stored Cross-Site Scripting

  The SlimStat Analytics plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'outbound_resource' parameter in the slimtrack AJAX action in all versions up to, and including, 5.3.2. This is due to insufficient input sanitization and output …

  VeronaLabs Slimstat Analytics Web / CMS
  Dec 19, 2025
• High 7.2
  CVE-2025-9816 Public exploit EPSS 12%

  WP Statistics <= 14.5.4 - Unauthenticated Stored Cross-Site Scripting via User-Agent Header

  The WP Statistics – The Most Popular Privacy-Friendly Analytics Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the User-Agent Header in all versions up to, and including, 14.5.4 due to insufficient input sanitization and output e…

  VeronaLabs WP Statistics – Simple, privacy-friendly Google Analytics alternative Web / CMS
  Sep 27, 2025
• High 7.2
  CVE-2024-9548

  Slimstat Analytics <= 5.2.6 - Unauthenticated Stored Cross-Site Scripting

  The SlimStat Analytics plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the resource parameter in all versions up to, and including, 5.2.6 due to insufficient input sanitization and output escaping when logging visitor requests. This make…

  VeronaLabs Slimstat Analytics Web / CMS
  Oct 14, 2024
• High 7.2
  CVE-2024-2194 EPSS 63%

  WP Statistics <= 14.5 - Unauthenticated Stored Cross-Site Scripting

  The WP Statistics plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the URL search parameter in all versions up to, and including, 14.5 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated …

  VeronaLabs WP Statistics – Simple, privacy-friendly Google Analytics alternative Web / CMS
  Mar 13, 2024
• High 7.1
  CVE-2024-24881

  WordPress WP SMS Plugin <= 6.5.2 is vulnerable to Cross Site Scripting (XSS)

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in VeronaLabs WP SMS – Messaging & SMS Notification for WordPress, WooCommerce, GravityForms, etc allows Reflected XSS.This issue affects WP SMS – Messaging & S…

  VeronaLabs WP SMS – Messaging & SMS Notification for WordPress, WooCommerce, GravityForms, etc Web / CMS
  Feb 8, 2024
• High 8.8
  CVE-2023-4598

  Slimstat Analytics <= 5.0.9 - Authenticated (Contributor+) Blind SQL Injection via Shortcode

  The Slimstat Analytics plugin for WordPress is vulnerable to SQL Injection via the plugin's shortcode in versions up to, and including, 5.0.9 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL qu…

  VeronaLabs Slimstat Analytics Web / CMS
  Oct 20, 2023
• High 7.1
  CVE-2023-32742

  WordPress WP SMS Plugin <= 6.1.4 is vulnerable to Cross Site Scripting (XSS)

  Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in VeronaLabs WP SMS plugin <= 6.1.4 versions.

  VeronaLabs WP SMS
  Aug 30, 2023