• WordPress Plugin WP Easy Stats is prone to a remote file include vulnerability because it fails to sufficiently sanitize user-supplied input. Exploiting this issue could allow an attacker to compromise the application and the underlying system; other attacks are also possible. WordPress Plugin WP Easy Stats version 1.8 is vulnerable; other versions may also be affected.

• Edit the source code to ensure that input is properly sanitised or disable the plugin until a fix is available

• • http://www.exploit-db.com/exploits/17862/
  • http://packetstormsecurity.com/files/view/105225/wpwpeasystats-rfi.txt
  • http://secunia.com/advisories/46069/

• 

• CWE-94

• CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

• Missing Update File Inclusion

• WordPress Plugin Subscribe2 Unspecified Vulnerability (10.20.5)
• WordPress Plugin Gallery-Video Gallery and Youtube Gallery SQL Injection (2.0.9)
• WordPress Plugin Responsive Category Slider Cross-Site Scripting (1.0)
• WordPress Plugin Essential Content Types Security Bypass (1.4)
• WordPress Plugin Haiku minimalist audio player Cross-Site Scripting (1.0.0)