Veronalabs
40 CVEs across 8 Veronalabs products. Browse Veronalabs vulnerabilities, severities, and proof-of-concept exploits.
Veronalabs products with known CVEs
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-54818 | High | 8.5 | 2026-06-17 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in VeronaLabs Slimstat Analytics allows Blind SQL Injection… |
CVE-2026-27410 | Medium | 6.5 | 2026-06-17 | Unauthenticated Deserialization of untrusted data in Slimstat Analytics < 5.4.0 versions. |
CVE-2026-40790 | Medium | 6.5 | 2026-06-15 | Subscriber Sensitive Data Exposure in WP SMS <= 7.2.1 versions. |
CVE-2026-48839 | High | 7.1 | 2026-06-01 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in VeronaLabs WP Statistics allows DOM-Based XSS. This issu… |
CVE-2026-7634 | High | 7.2 | 2026-05-28 | The SlimStat Analytics plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'User-Agent' header in all versions up to, and including, 5.4… |
CVE-2026-5231 | High | 7.2 | 2026-04-17 | The WP Statistics plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'utm_source' parameter in all versions up to, and including, 14.16… |
CVE-2026-3488 | Medium | 6.5 | 2026-04-17 | The WP Statistics plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 14.16.4. This is due to missing capability… |
CVE-2026-1238 | High | 7.2 | 2026-03-19 | The SlimStat Analytics plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'fh' (fingerprint) parameter in all versions up to, and includ… |
CVE-2026-28136 | High | 7.6 | 2026-02-26 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in VeronaLabs WP SMS wp-sms allows SQL Injection.This issue… |
CVE-2025-69323 | High | 7.1 | 2026-02-20 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in VeronaLabs Slimstat Analytics wp-slimstat allows Reflecte… |
CVE-2026-25343 | Medium | 5.9 | 2026-02-19 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in VeronaLabs WP SMS wp-sms allows DOM-Based XSS.This issue… |
CVE-2025-13431 | Medium | 6.5 | 2026-02-11 | The SlimStat Analytics plugin for WordPress is vulnerable to time-based SQL Injection via the ‘args’ parameter in all versions up to, and including, 5.3.1 due… |
CVE-2025-15057 | High | 7.2 | 2026-01-09 | The SlimStat Analytics plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the `fh` (fingerprint) parameter in all versions up to, and includ… |
CVE-2025-15055 | High | 7.2 | 2026-01-09 | The SlimStat Analytics plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'notes' and 'resource' parameters in all versions up to, and i… |
CVE-2025-14151 | High | 7.2 | 2025-12-19 | The SlimStat Analytics plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'outbound_resource' parameter in the slimtrack AJAX action in… |
CVE-2025-62006 | Medium | 5.4 | 2025-10-22 | Missing Authorization vulnerability in VeronaLabs WP SMS wp-sms.This issue affects WP SMS: from n/a through <= 7.0.1. |
CVE-2025-9816 | High | 7.2 | 2025-09-27 | The WP Statistics – The Most Popular Privacy-Friendly Analytics Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the User-Agent Hea… |
CVE-2025-55716 | Medium | 4.3 | 2025-08-14 | Missing Authorization vulnerability in VeronaLabs WP Statistics wp-statistics allows Exploiting Incorrectly Configured Access Control Security Levels.This issu… |
CVE-2025-3953 | Medium | 5.4 | 2025-04-30 | The WP Statistics – The Most Popular Privacy-Friendly Analytics Plugin plugin for WordPress is vulnerable to unauthorized modification of data due to a missing… |
CVE-2023-33994 | Medium | 6.5 | 2024-12-13 | Missing Authorization vulnerability in VeronaLabs Slimstat Analytics wp-slimstat allows Exploiting Incorrectly Configured Access Control Security Levels.This i… |
CVE-2024-9548 | High | 7.2 | 2024-10-15 | The SlimStat Analytics plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the resource parameter in all versions up to, and including, 5.2.6… |
CVE-2024-43331 | Medium | 5.3 | 2024-08-22 | Missing Authorization vulnerability in VeronaLabs WP SMS.This issue affects WP SMS: from n/a through 6.9.3. |
CVE-2024-34811 | Medium | 5.9 | 2024-05-14 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in VeronaLabs WP SMS allows Stored XSS.This issue affects WP… |
CVE-2024-30454 | Medium | 4.3 | 2024-03-29 | Cross-Site Request Forgery (CSRF) vulnerability in VeronaLabs WP SMS.This issue affects WP SMS: from n/a through 6.6.2. |
CVE-2024-25920 | Medium | 6.5 | 2024-03-27 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in VeronaLabs WP SMS allows Stored XSS.This issue affects WP… |
CVE-2024-2194 | High | 7.2 | 2024-03-13 | The WP Statistics plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the URL search parameter in all versions up to, and including, 14.5 due… |
CVE-2024-24881 | High | 7.1 | 2024-02-08 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in VeronaLabs WP SMS – Messaging & SMS Notification for Word… |
CVE-2024-1073 | Medium | 6.4 | 2024-02-02 | The SlimStat Analytics plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'filter_array' parameter in all versions up to, and including… |
CVE-2023-6981 | Medium | 6.1 | 2024-01-03 | The WP SMS – Messaging & SMS Notification for WordPress, WooCommerce, GravityForms, etc plugin for WordPress is vulnerable to SQL Injection via the 'group_id'… |
CVE-2023-6980 | Medium | 4.3 | 2024-01-03 | The WP SMS – Messaging & SMS Notification for WordPress, WooCommerce, GravityForms, etc plugin for WordPress is vulnerable to Cross-Site Request Forgery in all… |
CVE-2023-27447 | Medium | 5.3 | 2023-12-28 | Exposure of Sensitive Information to an Unauthorized Actor vulnerability in VeronaLabs WP SMS – Messaging & SMS Notification for WordPress, WooCommerce, Gravit… |
CVE-2023-4598 | High | 8.8 | 2023-10-20 | The Slimstat Analytics plugin for WordPress is vulnerable to SQL Injection via the plugin's shortcode in versions up to, and including, 5.0.9 due to insufficie… |
CVE-2023-32742 | High | 7.1 | 2023-08-30 | Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in VeronaLabs WP SMS plugin <= 6.1.4 versions. |
CVE-2023-4597 | Medium | 6.4 | 2023-08-30 | The Slimstat Analytics plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'slimstat' shortcode in versions up to, and including, 5.0.9 d… |
CVE-2023-0955 | High | 8.8 | 2023-03-27 | The WP Statistics WordPress plugin before 14.0 does not escape a parameter, which could allow authenticated users to perform SQL Injection attacks. By default… |
CVE-2022-38074 | High | 7.1 | 2023-03-13 | SQL Injection vulnerability in VeronaLabs WP Statistics plugin <= 13.2.10 versions. |
CVE-2021-4333 | Medium | 6.5 | 2023-03-07 | The WP Statistics plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 13.1.1. This is due to missing or incorrec… |
CVE-2022-4230 | High | 8.8 | 2023-01-23 | The WP Statistics WordPress plugin before 13.2.9 does not escape a parameter, which could allow authenticated users to perform SQL Injection attacks. By defaul… |
CVE-2022-27231 | Medium | 6.1 | 2022-06-13 | Cross-site scripting vulnerability exists in WP Statistics versions prior to 13.2.0 because it improperly processes a platform parameter. By exploiting this vu… |
CVE-2022-1005 | Medium | 6.1 | 2022-06-08 | The WP Statistics WordPress plugin before 13.2.2 does not sanitise the REQUEST_URI parameter before outputting it back in the rendered page, leading to Cross-S… |
CVE-2022-25307 | High | 7.2 | 2022-02-24 | The WP Statistics WordPress plugin is vulnerable to Cross-Site Scripting due to insufficient escaping and sanitization of the platform parameter found in the ~… |
CVE-2022-25306 | High | 7.2 | 2022-02-24 | The WP Statistics WordPress plugin is vulnerable to Cross-Site Scripting due to insufficient escaping and sanitization of the browser parameter found in the ~/… |
CVE-2022-25305 | High | 7.2 | 2022-02-24 | The WP Statistics WordPress plugin is vulnerable to Cross-Site Scripting due to insufficient escaping and sanitization of the IP parameter found in the ~/inclu… |
CVE-2022-25149 | Critical | 9.8 | 2022-02-24 | The WP Statistics WordPress plugin is vulnerable to SQL Injection due to insufficient escaping and parameterization of the IP parameter found in the ~/includes… |
CVE-2022-25148 | Critical | 9.8 | 2022-02-24 | The WP Statistics WordPress plugin is vulnerable to SQL Injection due to insufficient escaping and parameterization of the current_page_id parameter found in t… |
CVE-2022-0651 | Critical | 9.8 | 2022-02-24 | The WP Statistics WordPress plugin is vulnerable to SQL Injection due to insufficient escaping and parameterization of the current_page_type parameter found in… |
CVE-2022-0513 | Critical | 9.8 | 2022-02-16 | The WP Statistics WordPress plugin is vulnerable to SQL Injection due to insufficient escaping and parameterization of the exclusion_reason parameter found in… |
CVE-2021-24561 | Medium | 5.4 | 2021-08-23 | The WP SMS WordPress plugin before 5.4.13 does not sanitise the "wp_group_name" parameter before outputting it back in the "Groups" page, leading to an Authent… |
CVE-2021-24340 | High | 7.5 | 2021-06-07 | The WP Statistics WordPress plugin before 13.0.8 relied on using the WordPress esc_sql() function on a field not delimited by quotes and did not first prepare… |
CVE-2017-18515 | Critical | 9.8 | 2019-08-14 | The wp-statistics plugin before 12.0.8 for WordPress has SQL injection. |
CVE-2019-13275 | Critical | 9.8 | 2019-07-04 | An issue was discovered in the VeronaLabs wp-statistics plugin before 12.6.7 for WordPress. The v1/hit endpoint of the API, when the non-default "use cache plu… |
CVE-2019-12566 | Medium | 5.4 | 2019-06-03 | The WP Statistics plugin through 12.6.5 for Wordpress has stored XSS in includes/class-wp-statistics-pages.php. This is related to an account with the Editor r… |
CVE-2019-10864 | Medium | 6.1 | 2019-04-23 | The WP Statistics plugin through 12.6.2 for WordPress has XSS, allowing a remote attacker to inject arbitrary web script or HTML via the Referer header of a GE… |
CVE-2018-1000556 | Medium | 6.1 | 2018-06-26 | WordPress version 4.8 + contains a Cross Site Scripting (XSS) vulnerability in plugins.php or core wordpress on delete function that can result in An attacker… |