CVE-2022-25305: WP Statistics plugin IP parameter stored XSS in admin statistics pages

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 18 September 2026. Confidence: high.

high priorityPublic exploit code and a very high EPSS score make exploitation likely despite the medium CVSS rating and required user interaction.

What it is

The WP Statistics WordPress plugin fails to escape and sanitize the IP parameter in includes/class-wp-statistics-ip.php, allowing arbitrary script injection. Injected scripts execute when site administrators view the statistics pages, in versions up to and including 13.1.5.

Impact

An attacker can run arbitrary JavaScript in an authenticated administrator's browser, enabling session theft, privilege abuse, or further compromise of the WordPress site.

Attack surface

Reachable over the network without authentication; the victim administrator must view the affected statistics pages, so user interaction is required per the CVSS vector (AV:N/AC:L/PR:N/UI:R).

Exploitation

Not listed in CISA KEV, but EPSS is very high (0.789, 99.6th percentile) and a public exploit reference exists, indicating meaningful real-world exploitation likelihood.

What to do

• Update WP Statistics to a version newer than 13.1.5 (patch changeset 2679983).
• If immediate patching is not possible, disable or remove the plugin until it can be updated.
• Restrict access to WordPress admin statistics pages to trusted administrators only.
• Review administrator accounts and sessions for signs of compromise after exposure.

Detection

• Inspect web server and WordPress logs for requests containing script payloads in the IP parameter.
• Monitor for unexpected JavaScript or iframe content rendered on WP Statistics admin pages.
• Audit administrator sessions for anomalous activity following statistics page views.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.