Visitor statistics Vulnerabilities

This vulnerability allows an attacker to access sensitive information from the WP Visitor Statistics plugin, potentially exposing user data and site activity. It affects versions up to 6.9.4, so sites using this plugin without updates are at risk.

This vulnerability allows attackers to execute unauthorized SQL commands on the database of websites using the WP Visitor Statistics plugin, potentially exposing sensitive data. It can be exploited by anyone visiting the site, as no authentication is required to launch the attack.

This vulnerability allows an attacker with a low-level user role, like a contributor, to inject malicious scripts into the website, potentially leading to unauthorized actions or data theft. It occurs because the plugin fails to properly check and clean up certain inputs, making it easier for attackers to exploit.

This vulnerability allows an attacker to access and manipulate the database of a WordPress site using the Osamaesh WP Visitor Statistics plugin, potentially exposing sensitive information or altering data. It can be exploited without needing to log in, making it particularly dangerous for any site using this plugin version 5.7 or earlier.

This vulnerability allows an attacker with an authenticated user account to manipulate the database by injecting malicious SQL code through a poorly handled parameter in the WP Visitor Statistics plugin. If exploited, this could lead to unauthorized access to sensitive data or even complete control over the database.

This vulnerability allows an attacker to add any IP address to the exclusion list of the WP Visitor Statistics plugin, potentially blocking legitimate traffic. It requires the attacker to be an authenticated user or to trick a logged-in user into executing the action, and it could also lead to malicious scripts being run in the admin area due to poor input handling.

This vulnerability allows an attacker, even with a low-level user role like a subscriber, to execute SQL injection attacks, which means they could manipulate the database to access or alter sensitive information. The issue arises from the plugin not properly cleaning up user input in a specific function, making it accessible to any authenticated user.