Medium severity6.1OSV Advisory· Published Jun 26, 2018· Updated Jun 17, 2026

CVE-2018-1000556

Description

WordPress version 4.8 + contains a Cross Site Scripting (XSS) vulnerability in plugins.php or core wordpress on delete function that can result in An attacker can perform client side attacks which could be from stealing a cookie to code injection. This attack appear to be exploitable via an attacker must craft an URL with payload and send to the user. Victim need to open the link to be affected by reflected XSS. .

Affected products

Wp Statistics/Wp StatisticsOSV
WordPress/WordPressllm-fuzzy
Range: >=4.8
Package: https://wordpress.org/plugins/wordpress

Patches

Vulnerability mechanics

References

www.pluginvulnerabilities.com/2017/04/28/reflected-cross-site-scripting-xss-vulnerability-in-wp-statistics/nvdExploitThird Party Advisory

News mentions

No linked articles in our index yet.

cvss	0.397
epss	0.001
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000