Logo
Retour à la veille

CVE-2026-97652

Publié : 2 octobre 2026
Modifié : 2 octobre 2026
Lien officiel NVD
Score CVSS
6.1
MEDIUM

Description détaillée

The WP Statistics – Simple, privacy-friendly Google Analytics alternative plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via REQUEST_URI Query-Parameter Key in all versions up to, and including, 14.16.14 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.

Vecteur d'attaque (CVSS)

Vecteur brut :CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Références et Patchs

https://github.com/wp-statistics/wp-statistics/pull/1148https://plugins.trac.wordpress.org/browser/wp-statistics/tags/14.16.14/assets/dev/javascript/filters/generator.js#L383https://plugins.trac.wordpress.org/browser/wp-statistics/tags/14.16.14/assets/dev/javascript/filters/generator.js#L392https://plugins.trac.wordpress.org/browser/wp-statistics/tags/14.16.14/src/Abstracts/MultiViewPage.php#L82https://plugins.trac.wordpress.org/browser/wp-statistics/tags/14.16.14/src/Service/Admin/Referrals/ReferralsPage.php#L258https://plugins.trac.wordpress.org/browser/wp-statistics/tags/14.16.14/src/Service/Admin/Referrals/ReferralsPage.php#L283https://plugins.trac.wordpress.org/browser/wp-statistics/tags/14.16.14/src/Service/Admin/Referrals/ReferralsPage.php#L310https://plugins.trac.wordpress.org/changeset/3722421/wp-statistics/trunk/src/Service/Admin/Referrals/ReferralsPage.phphttps://plugins.trac.wordpress.org/changeset?reponame=&new=3722421%40wp-statistics%2Ftags%2F14.16.15&old=3702973%40wp-statistics%2Ftags%2F14.16.14https://www.wordfence.com/threat-intel/vulnerabilities/id/8f1d2fe2-816b-46ee-8ab5-ae9936ac9ded?source=cve

Dernières Vulnérabilités

CVE-2026-97876

A local attacker with control over GRUB's configuration can bypass lockdown restrictions when booting with Secure Boot and load an unsigned GRUB module, while GRUB continues to report lockdown is enabled. The vulnerability is caused by insufficient validation of the MMIO base address passed to the GRUB serial command. GRUB does not validate that the base address corresponds to a UART device, rather than being an arbitrary memory address. This allows an attacker to trick GRUB into writing non-arbitrary data at an attacker-controlled address, including resetting the grub_file_verifiers list in a way that disables the subsequent verification of loaded modules.

VOIR DÉTAILS

CVE-2026-96990

Allocation of Resources Without Limits or Throttling vulnerability in Apache Thrift Erlang bindings. This issue affects Apache Thrift: before 0.25.0. Users are recommended to upgrade to version 0.25.0, which fixes the issue.

VOIR DÉTAILS

CVE-2026-94651

improper handling of exceptional conditions, Missing release of resource after effective lifetime vulnerability in Apache Thrift java bindings. This issue affects Apache Thrift: before 0.25.0. Users are recommended to upgrade to version 0.25.0, which fixes the issue.

VOIR DÉTAILS