CVE-2022-33965

CRITICALNuclei

WordPress WP Visitor Statistics plugin <= 5.7 - Multiple Unauthenticated SQL Injection (SQLi) vulnerabilities

Title source: CVE List
STIX 2.1 vulnerability

Record summary

CVE-2022-33965 has a selected CVSS score of 9.3 (critical); EIP currently links 1 Nuclei template.

Description

Multiple Unauthenticated SQL Injection (SQLi) vulnerabilities in Osamaesh WP Visitor Statistics plugin <= 5.7 at WordPress.

Description source: CVE List

Exploitation context

Available material

Nuclei templates
1

CISA SSVC decision

ExploitationNone
AutomatableYes
Technical impactPartial

CISA Coordinator · SSVC 2.0.3 · Evaluated Feb 20, 2025 · Source: CVE List

Affected products and versions

1
ProductSourceVersion range

WP Visitor Statistics (WordPress plugin)

Browse Osamaesh / WP Visitor Statistics (WordPress plugin)
CVE List<= 5.7 to ≤ 5.7affected

Nuclei templates

1
ProjectDiscoveryCRITICALWordPress Visitor Statistics <=5.7 - SQL InjectionCVSS 9.8

WordPress Visitor Statistics plugin through 5.7 contains multiple unauthenticated SQL injection vulnerabilities. An attacker can possibly obtain sensitive information, modify data, and/or execute unauthorized administrative operations in the context of the affected site.

Impact

Successful exploitation of this vulnerability could allow an attacker to execute arbitrary SQL queries, potentially leading to unauthorized access, data leakage, or further compromise of the WordPress site.

Remediation

Update to the latest version of the WordPress Visitor Statistics plugin (>=5.8) to mitigate the SQL Injection vulnerability.

WeaknessesCWE-89
Authorstheamanrawat
Template tagstime-based-sqlicve2022cvewordpresswp-pluginwpunauthsqliwp-stats-managerplugins-marketvuln
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CPE: cpe:2.3:a:plugins-market:wp_visitor_statistics:*:*:*:*:*:wordpress:*:*
Shodan: http.html:"wp-stats-manager"
FOFA: body="wp-stats-manager"
Google: inurl:"/wp-content/plugins/wp-stats-manager"
https://patchstack.com/database/vulnerability/wp-stats-manager/wordpress-wp-visitor-statistics-plugin-5-7-multiple-unauthenticated-sql-injection-sqli-vulnerabilities https://wordpress.org/plugins/wp-stats-manager/ https://wordpress.org/plugins/wp-stats-manager/#developers https://nvd.nist.gov/vuln/detail/CVE-2022-33965 https://github.com/20142995/sectool

Source: ProjectDiscovery

References

3