Veronalabs develops a focused line of WordPress plugins—notably WP Statistics and WP SMS—that extend core WordPress functionality for analytics and messaging across a substantial installed base. Vulnerabilities affecting the vendor skew toward serious outcomes, with an elevated share reaching critical severity and a frequent tendency toward public exploit availability, reflecting the web-application and plugin-architecture context in which these tools operate. The exposure recurs consistently through application-layer weakness classes including cross-site scripting, SQL injection, cross-site request forgery, improper authorization, and exposure of sensitive information—flaws endemic to web plugins that handle user input, database queries, and authenticated operations without sufficient defenses. WordPress administrators should monitor this vendor's plugin updates closely, as compromised instances can affect site integrity and user data; live severity and exploitation counts are shown alongside this summary.
The number and severity of CVEs published that impact products developed by Veronalabs over time
Signals from CVEs in this vendor scope (35 CVEs).
35 CVEs · Highest risk first
| CVE | Published | CVSS | Risk | KEV | Exploit |
|---|---|---|---|---|---|
CVE-2022-25148CRITICAL The WP Statistics WordPress plugin is vulnerable to SQL Injection due to insufficient escaping and parameterization of the current_page_id parameter found in the ~/includes/class-w | Feb 24, 2022 | 9.8 | 87 | NO | YES |
CVE-2022-25149HIGH The WP Statistics WordPress plugin is vulnerable to SQL Injection due to insufficient escaping and parameterization of the IP parameter found in the ~/includes/class-wp-statistics- | Feb 24, 2022 | 7.5 | 77 | NO | YES |
CVE-2022-25305MEDIUM The WP Statistics WordPress plugin is vulnerable to Cross-Site Scripting due to insufficient escaping and sanitization of the IP parameter found in the ~/includes/class-wp-statisti | Feb 24, 2022 | 6.1 | 63 | NO | NO |
CVE-2022-0513HIGH The WP Statistics WordPress plugin is vulnerable to SQL Injection due to insufficient escaping and parameterization of the exclusion_reason parameter found in the ~/includes/class- | Feb 16, 2022 | 7.5 | 53 | NO | NO |
CVE-2021-24340HIGH The WP Statistics WordPress plugin before 13.0.8 relied on using the WordPress esc_sql() function on a field not delimited by quotes and did not first prepare the query. Additional | Jun 7, 2021 | 7.5 | 51 | NO | YES |
CVE-2022-4230HIGH The WP Statistics WordPress plugin before 13.2.9 does not escape a parameter, which could allow authenticated users to perform SQL Injection attacks. By default, the affected featu | Jan 23, 2023 | 8.8 | 47 | NO | NO |
CVE-2022-0651HIGH The WP Statistics WordPress plugin is vulnerable to SQL Injection due to insufficient escaping and parameterization of the current_page_type parameter found in the ~/includes/class | Feb 24, 2022 | 7.5 | 45 | NO | YES |
CVE-2026-48839HIGH Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in VeronaLabs WP Statistics allows DOM-Based XSS.
This issue affects WP Statisti | Jun 1, 2026 | 7.1 | 31 | NO | NO |
CVE-2019-13275CRITICAL An issue was discovered in the VeronaLabs wp-statistics plugin before 12.6.7 for WordPress. The v1/hit endpoint of the API, when the non-default "use cache plugin" setting is enabl | Jul 4, 2019 | 9.8 | 30 | NO | NO |
CVE-2024-43331CRITICAL Missing Authorization vulnerability in VeronaLabs WP SMS.This issue affects WP SMS: from n/a through 6.9.3. | Aug 22, 2024 | 9.8 | 29 | NO | NO |
Signals from CVEs in this vendor scope (35 CVEs).
An overview of all social media posts that mention a CVE ID that affects a product developed by Veronalabs.
Media articles that mention a CVE ID that affects a product developed by Veronalabs — matched by CVE ID, not by vendor name.