heart5 vulnerabilities

Products

• statpresscn 2

Latest heart5 CVEs

Newest publication first

1. CVE-2025-23544 WordPress StatPressCN plugin <= 1.9.1 - Reflected Cross Site Scripting (XSS) vulnerability

   Published 2025-01-23

   High·CVSS 7.1 EPSS 0.27%

   Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in heart5 StatPressCN statpresscn allows Reflected XSS.This issue affects StatPressCN: from n/a through <= 1.9.1.

2. CVE-2011-0641 StatPressCN <= 1.9.0 - Cross-Site Scripting

   Published 2011-01-25

   Medium·CVSS 4.3 EPSS 1.8%

   Multiple cross-site scripting (XSS) vulnerabilities in wp-admin/admin.php in the StatPressCN plugin 1.9.0 for WordPress allow remote attackers to inject arbitrary web script or HTML via the (1) what1, (2) what2, (3) what3, (4) what4, and (5) what5 parameters. NOTE: the provenance...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.