title: WP Statistics < 13.2.2 - Reflected Cross-Site Scripting
description: The WP Statistics WordPress plugin before 13.2.2 does not sanitise the REQUEST_URI parameter before outputting it back in the rendered page, leading to Cross-Site Scripting (XSS) in web browsers which do not encode characters
problem types: CWE-79 Cross-site Scripting (XSS)
affected:
{
product: WP Statistics
vendor: Unknown
versions:
lessThan: 13.2.2, status: affected, version: 13.2.2, versionType: custom
}