WP Statistics

WP Statistics before 12.0.8 concatenates the page/post ID and the search engine name into SQL queries without sanitising them. A user who can supply these values, for example through the [wpstatistics] shortcode attributes id and provider (any logged-in user can render shortcodes via the parse-media-shortcode AJAX action), can inject SQL and read data from the WordPress database. Fixed in 12.0.8.

This vulnerability affects the following application versions:

• WP Statistics 6.0
• WP Statistics 6.1
• WP Statistics 7.0
• WP Statistics 7.0.1
• WP Statistics 7.0.2
• WP Statistics 7.0.3
• WP Statistics 7.0.4
• WP Statistics 7.1
• WP Statistics 7.2
• WP Statistics 7.3
• WP Statistics 7.4
• WP Statistics 8.0
• WP Statistics 8.1
• WP Statistics 8.1.1
• WP Statistics 8.2
• WP Statistics 8.3
• WP Statistics 8.3.1
• WP Statistics 8.4
• WP Statistics 8.5
• WP Statistics 8.5.1
• WP Statistics 8.6
• WP Statistics 8.6.1
• WP Statistics 8.6.2
• WP Statistics 8.6.3
• WP Statistics 8.7
• WP Statistics 8.7.1
• WP Statistics 8.7.2
• WP Statistics 8.8
• WP Statistics 8.8.1
• WP Statistics 9.0
• WP Statistics 9.1
• WP Statistics 9.1.1
• WP Statistics 9.1.2
• WP Statistics 9.1.3
• WP Statistics 9.2
• WP Statistics 9.3
• WP Statistics 9.3.1
• WP Statistics 9.4
• WP Statistics 9.4.1
• WP Statistics 9.5
• WP Statistics 9.5.1
• WP Statistics 9.5.2
• WP Statistics 9.5.3
• WP Statistics 9.6
• WP Statistics 9.6.1
• WP Statistics 9.6.2
• WP Statistics 9.6.3
• WP Statistics 9.6.4
• WP Statistics 9.6.5
• WP Statistics 9.6.6
• WP Statistics 9.7
• WP Statistics 10.0
• WP Statistics 10.0.1
• WP Statistics 10.0.2
• WP Statistics 10.0.3
• WP Statistics 10.0.4
• WP Statistics 10.0.5
• WP Statistics 10.1
• WP Statistics 10.2
• WP Statistics 10.3
• WP Statistics 11.0
• WP Statistics 11.0.1
• WP Statistics 11.0.2
• WP Statistics 11.0.3
• WP Statistics 12.0
• WP Statistics 12.0.1
• WP Statistics 12.0.2
• WP Statistics 12.0.3
• WP Statistics 12.0.4
• WP Statistics 12.0.5
• WP Statistics 12.0.6
• WP Statistics 12.0.7