Veronalabs vulnerabilities
44 CVEs and advisories name Veronalabs as an affected vendor, newest first. Follow it as a feed.
- CVE-2026-97276WordPress WP Statistics plugin <= 14.16.14 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-97652WP Statistics <= 14.16.14 - Reflected Cross-Site Scripting via REQUEST_URI Query-Parameter Key
- CVE-2026-93770WordPress WP Statistics plugin <= 14.16.13 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-84774WordPress WP Statistics plugin <= 14.16.11 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-15780WP Statistics <= 14.16.8 - Unauthenticated Stored Cross-Site Scripting via 'utm_campaign' Parameter
- CVE-2026-54818WordPress Slimstat Analytics plugin <= 5.4.11 - SQL Injection vulnerability
- CVE-2026-27410WordPress Slimstat Analytics plugin < 5.4.0 - Deserialization of untrusted data vulnerability
- CVE-2026-40790WordPress WP SMS plugin <= 7.2.1 - Sensitive Data Exposure vulnerability
- CVE-2026-48839WordPress WP Statistics plugin <= 14.16.6 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-7634SlimStat Analytics <= 5.4.11 - Unauthenticated Stored Cross-Site Scripting via User-Agent Header
- CVE-2026-3488WP Statistics <= 14.16.4 - Missing Authorization to Authenticated (Subscriber+) Sensitive Information Exposure and Privacy Audit Manipulation
- CVE-2026-5231WP Statistics <= 14.16.4 - Unauthenticated Stored Cross-Site Scripting via 'utm_source' Parameter
- CVE-2026-1238SlimStat Analytics <= 5.3.5 - Unauthenticated Stored Cross-Site Scripting via 'fh'
- CVE-2026-28136WordPress WP SMS plugin <= 6.9.12 - SQL Injection vulnerability
- CVE-2025-69323WordPress Slimstat Analytics plugin <= 5.3.2 - Reflected Cross Site Scripting (XSS) vulnerability
- CVE-2026-25343WordPress WP SMS plugin <= 7.1 - Cross Site Scripting (XSS) vulnerability
- CVE-2025-13431SlimStat Analytics <= 5.3.1 - Authenticated (Subscriber+) SQL Injection via `args` Parameter
- CVE-2025-15055SlimStat Analytics <= 5.3.4 - Unauthenticated Stored Cross-Site Scripting via 'notes/resource' Parameters
- CVE-2025-15057SlimStat Analytics <= 5.3.3 - Unauthenticated Stored Cross-Site Scripting via 'fh' Parameter
- CVE-2025-14151SlimStat Analytics <= 5.3.2 - Unauthenticated Stored Cross-Site Scripting
- CVE-2025-62006WordPress WP SMS plugin <= 7.0.1 - Broken Access Control vulnerability
- CVE-2025-9816WP Statistics <= 14.5.4 - Unauthenticated Stored Cross-Site Scripting via User-Agent Header
- CVE-2025-55716WordPress WP Statistics Plugin <= 14.15 - Broken Access Control Vulnerability
- CVE-2025-3953WP Statistics – The Most Popular Privacy-Friendly Analytics Plugin <= 14.13.3 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Plugin Settings Update
- CVE-2023-33994WordPress Slimstat Analytics plugin <= 5.0.5.1 - Broken Access Control vulnerability
- CVE-2024-9548Slimstat Analytics <= 5.2.6 - Unauthenticated Stored Cross-Site Scripting
- CVE-2024-43331WordPress WP SMS plugin <= 6.9.3 - Broken Access Control vulnerability
- CVE-2024-34811WordPress WP SMS plugin <= 6.5.1 - Cross Site Scripting (XSS) vulnerability
- CVE-2024-30454WordPress WP SMS plugin <= 6.6.2 - Cross Site Request Forgery (CSRF) vulnerability
- CVE-2024-25920WordPress WP SMS plugin <= 6.3.4 - Cross Site Scripting (XSS) vulnerability