CVE-2022-25305

What it actually does

This is a stored cross-site scripting vulnerability caused by insufficient validation, escaping, and sanitization of an IP-related parameter in the WP Statistics WordPress plugin, specifically in logic associated with includes/class-wp-statistics-ip.php. An unauthenticated network attacker can submit crafted input containing JavaScript or HTML payloads that are stored or reflected into statistics views. When a privileged WordPress user, such as a site administrator, later views affected statistics pages, the attacker-controlled script executes in that administrator’s browser session. Technical consequences can include theft of session cookies if not protected, abuse of administrator browser privileges, unauthorized WordPress configuration changes, malicious plugin/theme installation, user creation, content modification, or pivoting to other browser-accessible administrative functions. The supplied affected-package metadata references OpenZeppelin packages and fixed versions, which does not align with the WordPress plugin vulnerability description; teams should validate the advisory source before applying package-specific remediation.

Why it matters to the business

Successful exploitation can allow an external attacker to compromise a WordPress administrator’s browser session and potentially take over or alter a website, publish malicious content, redirect visitors, inject skimmers or SEO spam, and damage brand trust. Although the CVSS score is moderate, the EPSS score is high and exploit code is available, so internet-facing WordPress sites using affected WP Statistics versions should be treated as a priority even though this vulnerability is not currently listed in CISA KEV and is not known from the provided data to be associated with ransomware campaigns. The package metadata supplied with this record appears inconsistent with the described WordPress plugin issue, which creates an operational risk of patching the wrong component if asset owners do not verify product applicability.

How an attack unfolds

An attacker identifies a WordPress site running a vulnerable version of the WP Statistics plugin, up to and including 13.1.5. The attacker sends a crafted request that places a script payload into the vulnerable IP-related parameter or into an IP-derived value processed by the plugin. Because the plugin does not correctly sanitize the value before storing or displaying it, the payload is preserved in statistics data or rendered into administrative statistics pages. The attacker then waits for a site administrator or other privileged user to open the affected WP Statistics dashboard or reporting views. When the page loads, the malicious script runs in the trusted WordPress admin context, allowing the attacker to perform actions available to that user’s browser session, such as issuing authenticated requests, modifying site settings, creating users, planting additional JavaScript, or redirecting traffic.

How to fix it

Upgrade the WP Statistics WordPress plugin to a version later than 13.1.5 that contains the vendor fix, and remove or disable the plugin until it can be updated if immediate patching is not possible. After upgrading, clear any cached statistics pages and review existing statistics records for embedded HTML or JavaScript payloads because stored XSS data may persist after patching. Enforce least privilege for WordPress administrators, require multi-factor authentication, restrict access to WordPress administrative paths where possible, and deploy a web application firewall rule to block script-like payloads in IP-related parameters and forwarding headers. The supplied fixed-version metadata lists OpenZeppelin/openzeppelin-contracts fixed at commit 3b8b4ba82c880c31cd3b96dd5e15741d7e26658e and @openzeppelin/contracts plus @openzeppelin/contracts-upgradeable fixed in 4.7.1; however, those packages do not match the WP Statistics XSS description, so validate whether this record is incorrectly mapped before using those package versions as remediation evidence.

How to confirm the fix worked

Confirm the installed WP Statistics plugin version is greater than 13.1.5 or that the vulnerable plugin is removed or disabled. Review the vulnerable source path, includes/class-wp-statistics-ip.php, to ensure IP-derived values are sanitized on input and escaped on output. In a controlled test environment only, submit benign encoded HTML such as a harmless marker string through the suspected IP-related input path and verify it is rendered as text rather than executed in WP Statistics administrative pages. Confirm that WordPress plugin inventory, vulnerability scanners, software composition analysis, and administrative plugin pages all report the remediated version. Search historical statistics data and logs for stored script payloads to ensure malicious content is not still present after patching.

Typical attack path

1. Reconnoiter public WordPress sites and fingerprint the presence and version of the WP Statistics plugin.
2. Confirm that the deployed plugin version is affected, particularly versions up to and including 13.1.5.
3. Send a crafted HTTP request containing JavaScript or HTML payloads in the vulnerable IP-related parameter or spoofable IP-derived input.
4. Cause the payload to be stored or displayed in WP Statistics reporting views.
5. Wait for a WordPress administrator to view the affected statistics page.
6. Execute attacker-controlled JavaScript in the administrator’s browser session.
7. Use the administrator’s authenticated context to perform unauthorized WordPress actions, steal sensitive page data, create persistence, inject further malicious content, or redirect visitors.

How to detect it

To determine whether this was already exploited, review HTTP access logs, WAF events, CDN logs, reverse proxy logs, and WordPress security/audit logs for requests containing HTML or JavaScript payloads in IP-related parameters, visitor tracking requests, query strings, or forwarding headers. Pay special attention to requests followed by WordPress administrator access to WP Statistics pages, because exploitation requires an administrator or privileged user to view the poisoned statistics entry. Inspect stored WP Statistics data through safe, non-rendering tools for encoded or raw payloads such as script tags, event handlers, SVG payloads, iframe tags, JavaScript URLs, or encoded variants. Review WordPress admin activity after suspicious statistics-page views for creation of new administrator users, plugin or theme installation, changes to site URLs, injected redirects, unfamiliar JavaScript in posts/widgets/theme files, and unexpected modifications to PHP files. Browser-side evidence may be limited, so correlate suspicious inbound payloads with admin session activity, file changes, and outbound connections from administrator browsers or the web server. No named threat actors are provided for this record.

• /wp-content/plugins/wp-statistics/includes/class-wp-statistics-ip.php
• /wp-content/plugins/wp-statistics/
• wp-statistics
• %3Cscript
• <script
• %3C%2Fscript%3E
• </script>
• onerror=
• onload=
• onclick=
• javascript:
• %6a%61%76%61%73%63%72%69%70%74%3a
• <svg
• %3Csvg
• <iframe
• %3Ciframe
• document.cookie
• document.location
• window.location
• eval(
• String.fromCharCode
• X-Forwarded-For: <
• X-Forwarded-For: %3C
• X-Real-IP: <
• X-Real-IP: %3C
• Client-IP: <
• Client-IP: %3C

What your security team should do

• Prioritize internet-facing WordPress sites running WP Statistics versions up to and including 13.1.5 because exploit code is available and EPSS indicates elevated likelihood of exploitation.
• Validate product applicability immediately because the vulnerability description references the WP Statistics WordPress plugin while the supplied affected-package metadata references OpenZeppelin packages.
• Patch or disable vulnerable WP Statistics deployments, then verify the plugin version from the WordPress admin interface and filesystem package metadata.
• Hunt web access logs, WAF logs, reverse proxy logs, and WordPress activity logs for script-like payloads in IP-related inputs, query strings, and forwarding headers.
• Inspect WP Statistics administrative views and stored statistics records for injected HTML or JavaScript that may remain after upgrade.
• Force password resets and revoke active sessions for WordPress administrators if exploitation is suspected.
• Review WordPress users, plugins, themes, scheduled tasks, and recently modified files for unauthorized changes following any suspected administrator-session compromise.
• Deploy or tune WAF rules to block obvious XSS payloads in parameters and headers such as X-Forwarded-For, X-Real-IP, Client-IP, and query parameters associated with statistics views.