Medium severity · published Mar 7, 2023
CVE-2021-4333
WP Statistics <= 13.1.1 - Cross-Site Request Forgery to Arbitrary Plugin Activation and Deactivation
6.5
CVSS
0.4%
EPSS
No
On KEV
Description
The WP Statistics plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 13.1.1. This is due to missing or incorrect nonce validation on the view() function. This makes it possible for unauthenticated attackers to activate and deactivate arbitrary plugins, via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
Required
Confidentiality
None
Integrity
High
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 31% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
WS
WP Statistics – Simple, privacy-friendly Google Analytics alternative · veronalabs
through 13.1.1 · source: vendor
WS
WP Statistics · Veronalabs
through 13.1.1 · source: NVD
Affected product
WS
WP Statistics – Simple, privacy-friendly Google Analytics alternative
veronalabs
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2021-4333
CVE.org
https://www.cve.org/CVERecord?id=CVE-2021-4333
Patch
https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=2626597%40wp-statistics&new=2626597%40wp-statistics&sfp_email=&sfph_mail=
www.wordfence.com
https://www.wordfence.com/threat-intel/vulnerabilities/id/215937d9-739b-4198-b375-6d171bbac64a?source=cve
Third Party Advisory
https://www.wordfence.com/threat-intel/vulnerabilities/id/215937d9-739b-4198-b375-6d171bbac64a
More from WP Statistics – Simple, privacy-friendly Google Analytics alternative
7.2
CVE-2026-15780
WP Statistics <= 14.16.8 - Unauthenticated Stored Cross-Site Scripting via 'utm_campaign' Parameter
7.2
CVE-2026-5231
WP Statistics <= 14.16.4 - Unauthenticated Stored Cross-Site Scripting via 'utm_source' Parameter
7.2
CVE-2025-9816
WP Statistics <= 14.5.4 - Unauthenticated Stored Cross-Site Scripting via User-Agent Header
7.2
CVE-2024-2194
WP Statistics <= 14.5 - Unauthenticated Stored Cross-Site Scripting
6.5
CVE-2026-3488
WP Statistics <= 14.16.4 - Missing Authorization to Authenticated (Subscriber+) Sensitive Information Exposure and Privacy Audit Manipulation