Vulnerability Details CVE-2015-10001
The WP-Stats WordPress plugin before 2.52 does not have CSRF check when saving its settings, and did not escape some of them when outputting them, allowing attacker to make logged in high privilege users change them and set Cross-Site Scripting payloads
Exploit prediction scoring system (EPSS) score
EPSS Score 0.001
EPSS Ranking 29.0%
CVSS Severity
CVSS v3 Score 4.3
CVSS v2 Score 4.3
References
Products affected by CVE-2015-10001
-
cpe:2.3:a:wp-stats_project:wp-stats:-
-
cpe:2.3:a:wp-stats_project:wp-stats:1.00
-
cpe:2.3:a:wp-stats_project:wp-stats:2.00
-
cpe:2.3:a:wp-stats_project:wp-stats:2.01
-
cpe:2.3:a:wp-stats_project:wp-stats:2.02
-
cpe:2.3:a:wp-stats_project:wp-stats:2.03
-
cpe:2.3:a:wp-stats_project:wp-stats:2.04
-
cpe:2.3:a:wp-stats_project:wp-stats:2.05
-
cpe:2.3:a:wp-stats_project:wp-stats:2.06
-
cpe:2.3:a:wp-stats_project:wp-stats:2.10
-
cpe:2.3:a:wp-stats_project:wp-stats:2.11
-
cpe:2.3:a:wp-stats_project:wp-stats:2.20
-
cpe:2.3:a:wp-stats_project:wp-stats:2.30
-
cpe:2.3:a:wp-stats_project:wp-stats:2.31
-
cpe:2.3:a:wp-stats_project:wp-stats:2.40
-
cpe:2.3:a:wp-stats_project:wp-stats:2.50
-
cpe:2.3:a:wp-stats_project:wp-stats:2.51