# cve.now: Veronalabs

The newest entries naming Veronalabs as an affected vendor (up to 200), of 44 in all, 0 known exploited. Older ones are in the full catalog at https://cve.now/latest.md.

- [CVE-2026-97276](https://cve.now/CVE-2026-97276.md): WordPress WP Statistics plugin \<= 14.16.14 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1)
- [CVE-2026-97652](https://cve.now/CVE-2026-97652.md): WP Statistics \<= 14.16.14 - Reflected Cross-Site Scripting via REQUEST\_URI Query-Parameter Key (CVSS 6.1)
- [CVE-2026-93770](https://cve.now/CVE-2026-93770.md): WordPress WP Statistics plugin \<= 14.16.13 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1)
- [CVE-2026-84774](https://cve.now/CVE-2026-84774.md): WordPress WP Statistics plugin \<= 14.16.11 - Cross Site Scripting (XSS) vulnerability (CVSS 6.1)
- [CVE-2026-15780](https://cve.now/CVE-2026-15780.md): WP Statistics \<= 14.16.8 - Unauthenticated Stored Cross-Site Scripting via 'utm\_campaign' Parameter (CVSS 7.2)
- [CVE-2026-54818](https://cve.now/CVE-2026-54818.md): WordPress Slimstat Analytics plugin \<= 5.4.11 - SQL Injection vulnerability (CVSS 8.5)
- [CVE-2026-27410](https://cve.now/CVE-2026-27410.md): WordPress Slimstat Analytics plugin \< 5.4.0 - Deserialization of untrusted data vulnerability (CVSS 6.5)
- [CVE-2026-40790](https://cve.now/CVE-2026-40790.md): WordPress WP SMS plugin \<= 7.2.1 - Sensitive Data Exposure vulnerability (CVSS 6.5)
- [CVE-2026-48839](https://cve.now/CVE-2026-48839.md): WordPress WP Statistics plugin \<= 14.16.6 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1)
- [CVE-2026-7634](https://cve.now/CVE-2026-7634.md): SlimStat Analytics \<= 5.4.11 - Unauthenticated Stored Cross-Site Scripting via User-Agent Header (CVSS 7.2)
- [CVE-2026-3488](https://cve.now/CVE-2026-3488.md): WP Statistics \<= 14.16.4 - Missing Authorization to Authenticated (Subscriber+) Sensitive Information Exposure and Privacy Audit Manipulation (CVSS 6.5)
- [CVE-2026-5231](https://cve.now/CVE-2026-5231.md): WP Statistics \<= 14.16.4 - Unauthenticated Stored Cross-Site Scripting via 'utm\_source' Parameter (CVSS 7.2)
- [CVE-2026-1238](https://cve.now/CVE-2026-1238.md): SlimStat Analytics \<= 5.3.5 - Unauthenticated Stored Cross-Site Scripting via 'fh' (CVSS 7.2)
- [CVE-2026-28136](https://cve.now/CVE-2026-28136.md): WordPress WP SMS plugin \<= 6.9.12 - SQL Injection vulnerability (CVSS 7.6)
- [CVE-2025-69323](https://cve.now/CVE-2025-69323.md): WordPress Slimstat Analytics plugin \<= 5.3.2 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1)
- [CVE-2026-25343](https://cve.now/CVE-2026-25343.md): WordPress WP SMS plugin \<= 7.1 - Cross Site Scripting (XSS) vulnerability (CVSS 5.9)
- [CVE-2025-13431](https://cve.now/CVE-2025-13431.md): SlimStat Analytics \<= 5.3.1 - Authenticated (Subscriber+) SQL Injection via \`args\` Parameter (CVSS 6.5)
- [CVE-2025-15055](https://cve.now/CVE-2025-15055.md): SlimStat Analytics \<= 5.3.4 - Unauthenticated Stored Cross-Site Scripting via 'notes/resource' Parameters (CVSS 7.2)
- [CVE-2025-15057](https://cve.now/CVE-2025-15057.md): SlimStat Analytics \<= 5.3.3 - Unauthenticated Stored Cross-Site Scripting via 'fh' Parameter (CVSS 7.2)
- [CVE-2025-14151](https://cve.now/CVE-2025-14151.md): SlimStat Analytics \<= 5.3.2 - Unauthenticated Stored Cross-Site Scripting (CVSS 7.2)
- [CVE-2025-62006](https://cve.now/CVE-2025-62006.md): WordPress WP SMS plugin \<= 7.0.1 - Broken Access Control vulnerability (CVSS 5.4)
- [CVE-2025-9816](https://cve.now/CVE-2025-9816.md): WP Statistics \<= 14.5.4 - Unauthenticated Stored Cross-Site Scripting via User-Agent Header (CVSS 7.2)
- [CVE-2025-55716](https://cve.now/CVE-2025-55716.md): WordPress WP Statistics Plugin \<= 14.15 - Broken Access Control Vulnerability (CVSS 4.3)
- [CVE-2025-3953](https://cve.now/CVE-2025-3953.md): WP Statistics – The Most Popular Privacy-Friendly Analytics Plugin \<= 14.13.3 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Plugin Settings Update (CVSS 5.4)
- [CVE-2023-33994](https://cve.now/CVE-2023-33994.md): WordPress Slimstat Analytics plugin \<= 5.0.5.1 - Broken Access Control vulnerability (CVSS 6.5)
- [CVE-2024-9548](https://cve.now/CVE-2024-9548.md): Slimstat Analytics \<= 5.2.6 - Unauthenticated Stored Cross-Site Scripting (CVSS 7.2)
- [CVE-2024-43331](https://cve.now/CVE-2024-43331.md): WordPress WP SMS plugin \<= 6.9.3 - Broken Access Control vulnerability (CVSS 5.3)
- [CVE-2024-34811](https://cve.now/CVE-2024-34811.md): WordPress WP SMS plugin \<= 6.5.1 - Cross Site Scripting (XSS) vulnerability (CVSS 5.9)
- [CVE-2024-30454](https://cve.now/CVE-2024-30454.md): WordPress WP SMS plugin \<= 6.6.2 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 4.3)
- [CVE-2024-25920](https://cve.now/CVE-2024-25920.md): WordPress WP SMS plugin \<= 6.3.4 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5)
- [CVE-2024-2194](https://cve.now/CVE-2024-2194.md): WP Statistics \<= 14.5 - Unauthenticated Stored Cross-Site Scripting (CVSS 7.2)
- [CVE-2024-24881](https://cve.now/CVE-2024-24881.md): WordPress WP SMS Plugin \<= 6.5.2 is vulnerable to Cross Site Scripting (XSS) (CVSS 7.1)
- [CVE-2024-1073](https://cve.now/CVE-2024-1073.md): SlimStat Analytics \<= 5.1.3 - Authenticated (Subscriber+) Stored Cross-Site Scripting (CVSS 6.4)
- [CVE-2023-6981](https://cve.now/CVE-2023-6981.md): WP SMS \<= 6.5 - Authenticated (Admin+) SQL Injection to Reflected Cross-Site Scripting (CVSS 6.1)
- [CVE-2023-6980](https://cve.now/CVE-2023-6980.md): WP SMS \<= 6.5 - Cross-Site Request Forgery to Subscriber Deletion (CVSS 4.3)
- [CVE-2023-27447](https://cve.now/CVE-2023-27447.md): WordPress WP SMS Plugin \<= 6.0.4 is vulnerable to Sensitive Data Exposure (CVSS 5.3)
- [CVE-2023-4598](https://cve.now/CVE-2023-4598.md): Slimstat Analytics \<= 5.0.9 - Authenticated (Contributor+) Blind SQL Injection via Shortcode (CVSS 8.8)
- [CVE-2023-32742](https://cve.now/CVE-2023-32742.md): WordPress WP SMS Plugin \<= 6.1.4 is vulnerable to Cross Site Scripting (XSS) (CVSS 7.1)
- [CVE-2023-4597](https://cve.now/CVE-2023-4597.md): Slimstat Analytics \<= 5.0.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode (CVSS 6.4)
- [CVE-2022-38074](https://cve.now/CVE-2022-38074.md): WordPress WP Statistics Plugin \<= 13.2.10 is vulnerable to SQL Injection (CVSS 9.9)
- [CVE-2021-4333](https://cve.now/CVE-2021-4333.md): WP Statistics \<= 13.1.1 - Cross-Site Request Forgery to Arbitrary Plugin Activation and Deactivation (CVSS 6.5)
- [CVE-2022-27231](https://cve.now/CVE-2022-27231.md): Cross-site scripting vulnerability exists in WP Statistics versions prior to 13.2.0 because it improperly processes a platform parameter. (no CVSS)
- [CVE-2022-0513](https://cve.now/CVE-2022-0513.md): WP Statistics \<= 13.1.4 Unauthenticated Blind SQL Injection via exclusion\_reason (CVSS 9.8)
- [CVE-2021-24340](https://cve.now/CVE-2021-24340.md): WP Statistics \< 13.0.8 - Unauthenticated SQL Injection (no CVSS)

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/vendors/veronalabs
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.