Threat database

31 threats

Threat database
Severity	CVSS	Signals	Threat	Source	Published
Medium	5.4	EPSS 0.3%	CVE-2025-62006WP SMS · Missing Authorization Medium5.4EPSS 0.3%2025-10-22CVE Database V5CVE-2025-62006 Missing Authorization vulnerability in VeronaLabs WP SMS wp-sms.This issue affects WP SMS: from n/a through <= 7.0.1. EPSS 0.3%Vulnerability VeronaLabs	CVE Database V5	2025-10-22
High	7.2	EPSS 10%	CVE-2025-9816WP Statistics – Simple, privacy-friendly Google Analytics alternative · Cross-site Scripting High7.2EPSS 10%2025-09-27CVE Database V5CVE-2025-9816 The WP Statistics – The Most Popular Privacy-Friendly Analytics Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the User-Agent Header in all versions up to, and including, 14.5.4 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. EPSS 10%Vulnerability veronalabs #cwe-79	CVE Database V5	2025-09-27
Medium	4.3	EPSS 0.2%	CVE-2025-55716WP Statistics · Missing Authorization Medium4.3EPSS 0.2%2025-08-14CVE Database V5CVE-2025-55716 Missing Authorization vulnerability in VeronaLabs WP Statistics wp-statistics allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Statistics: from n/a through <= 14.15. EPSS 0.2%Vulnerability VeronaLabs	CVE Database V5	2025-08-14
High	7.2	EPSS 0.5%	CVE-2024-9548SlimStat Analytics · Cross-site Scripting High7.2EPSS 0.5%2024-10-14CVE Database V5CVE-2024-9548 The SlimStat Analytics plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the resource parameter in all versions up to, and including, 5.2.6 due to insufficient input sanitization and output escaping when logging visitor requests. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. EPSS 0.5%Vulnerability veronalabs #cwe-79	CVE Database V5	2024-10-14
Medium	5.3	EPSS 0.4%	CVE-2024-43331WP SMS · Missing Authorization Medium5.3EPSS 0.4%2024-08-22CVE Database V5CVE-2024-43331 Missing Authorization vulnerability in VeronaLabs WP SMS.This issue affects WP SMS: from n/a through 6.9.3. EPSS 0.4%Vulnerability VeronaLabs #cwe-862	CVE Database V5	2024-08-22
Medium	5.9	EPSS 0.4%	CVE-2024-34811WP SMS · Cross-site Scripting Medium5.9EPSS 0.4%2024-05-13CVE Database V5CVE-2024-34811 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in VeronaLabs WP SMS allows Stored XSS.This issue affects WP SMS: from n/a through 6.5.1. EPSS 0.4%Vulnerability VeronaLabs #cwe-79	CVE Database V5	2024-05-13
Medium	4.3	EPSS 0.2%	CVE-2024-30454WP SMS · Cross-Site Request Forgery (CSRF) Medium4.3EPSS 0.2%2024-03-29CVE Database V5CVE-2024-30454 Cross-Site Request Forgery (CSRF) vulnerability in VeronaLabs WP SMS.This issue affects WP SMS: from n/a through 6.6.2. EPSS 0.2%Vulnerability VeronaLabs #cwe-352	CVE Database V5	2024-03-29
Medium	6.5	EPSS 0.3%	CVE-2024-25920WP SMS · Cross-site Scripting Medium6.5EPSS 0.3%2024-03-27CVE Database V5CVE-2024-25920 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in VeronaLabs WP SMS allows Stored XSS.This issue affects WP SMS: from n/a through 6.3.4. EPSS 0.3%Vulnerability VeronaLabs #cwe-79	CVE Database V5	2024-03-27
High	7.2	EPSS 67%	CVE-2024-2194WP Statistics – Simple, privacy-friendly Google Analytics alternative · Cross-site Scripting High7.2EPSS 67%2024-03-13CVE Database V5CVE-2024-2194 The WP Statistics plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the URL search parameter in all versions up to, and including, 14.5 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. EPSS 67%Vulnerability veronalabs #cwe-79	CVE Database V5	2024-03-13
High	7.1	EPSS 0.4%	CVE-2024-24881WP SMS – Messaging & SMS Notification for WordPress, WooCommerce, GravityForms, etc · Cross-site Scripting High7.1EPSS 0.4%2024-02-08CVE Database V5CVE-2024-24881 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in VeronaLabs WP SMS – Messaging & SMS Notification for WordPress, WooCommerce, GravityForms, etc allows Reflected XSS.This issue affects WP SMS – Messaging & SMS Notification for WordPress, WooCommerce, GravityForms, etc: from n/a through 6.5.2. EPSS 0.4%Vulnerability VeronaLabs #cwe-79	CVE Database V5	2024-02-08
Medium	6.4	EPSS 0.4%	CVE-2024-1073SlimStat Analytics · Cross-site Scripting Medium6.4EPSS 0.4%2024-02-02CVE Database V5CVE-2024-1073 The SlimStat Analytics plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'filter_array' parameter in all versions up to, and including, 5.1.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. EPSS 0.4%Vulnerability veronalabs #cwe-79	CVE Database V5	2024-02-02

Showing 21–31 of 31 results