{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-3869", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "state": "PUBLISHED", "assignerShortName": "Wordfence", "dateReserved": "2025-04-22T14:51:57.874Z", "datePublished": "2025-05-24T02:23:03.204Z", "dateUpdated": "2026-04-08T16:49:32.037Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T16:49:32.037Z"}, "affected": [{"vendor": "4stats", "product": "4stats", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "2.0.9", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The 4stats plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.0.9. This is due to missing or incorrect nonce validation on the stats/stats.php page. This makes it possible for unauthenticated attackers to update settings and inject malicious web scripts via a forged request granted they can trick a site administrator into performing an action such as clicking on a link."}], "title": "4stats <= 2.0.9 - Cross-Site Request Forgery to Stored Cross-Site Scripting", "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/453b246f-7e39-4adb-9506-77d96146ab50?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/4stats/tags/2.0.9/4stats.php"}, {"url": "https://wordpress.org/plugins/4stats/"}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", "cweId": "CWE-79", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "baseScore": 6.1, "baseSeverity": "MEDIUM"}}], "credits": [{"lang": "en", "type": "finder", "value": "JohSka"}], "timeline": [{"time": "2025-05-23T13:53:37.000Z", "lang": "en", "value": "Disclosed"}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-05-24T10:07:46.822072Z", "id": "CVE-2025-3869", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-05-24T10:10:08.770Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-3869", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-05-24T10:07:46.822072Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-05-24T10:10:05.294Z"}}], "cna": {"title": "4stats <= 2.0.9 - Cross-Site Request Forgery to Stored Cross-Site Scripting", "credits": [{"lang": "en", "type": "finder", "value": "JohSka"}], "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 6.1, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"}}], "affected": [{"vendor": "4stats", "product": "4stats", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "2.0.9"}], "defaultStatus": "unaffected"}], "timeline": [{"lang": "en", "time": "2025-05-23T13:53:37.000Z", "value": "Disclosed"}], "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/453b246f-7e39-4adb-9506-77d96146ab50?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/4stats/tags/2.0.9/4stats.php"}, {"url": "https://wordpress.org/plugins/4stats/"}], "descriptions": [{"lang": "en", "value": "The 4stats plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.0.9. This is due to missing or incorrect nonce validation on the stats/stats.php page. This makes it possible for unauthenticated attackers to update settings and inject malicious web scripts via a forged request granted they can trick a site administrator into performing an action such as clicking on a link."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-79", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')"}]}], "providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T16:49:32.037Z"}}}, "cveMetadata": {"cveId": "CVE-2025-3869", "state": "PUBLISHED", "dateUpdated": "2026-04-08T16:49:32.037Z", "dateReserved": "2025-04-22T14:51:57.874Z", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "datePublished": "2025-05-24T02:23:03.204Z", "assignerShortName": "Wordfence"}, "dataVersion": "5.2"}

{"cveTags": [], "descriptions": [{"lang": "en", "value": "The 4stats plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.0.9. This is due to missing or incorrect nonce validation on the stats/stats.php page. This makes it possible for unauthenticated attackers to update settings and inject malicious web scripts via a forged request granted they can trick a site administrator into performing an action such as clicking on a link."}, {"lang": "es", "value": "El complemento 4stats para WordPress es vulnerable a Cross-Site Request Forgery en todas las versiones hasta la 2.0.9 incluida. Esto se debe a la falta o a una validaci\u00f3n incorrecta de nonce en la p\u00e1gina stats/stats.php. Esto permite que atacantes no autenticados actualicen la configuraci\u00f3n e inyecten scripts web maliciosos mediante una solicitud falsificada, ya que pueden enga\u00f1ar al administrador del sitio para que realice una acci\u00f3n como hacer clic en un enlace."}], "id": "CVE-2025-3869", "lastModified": "2026-04-15T00:35:42.020", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.1, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 2.7, "source": "security@wordfence.com", "type": "Secondary"}]}, "published": "2025-05-24T03:15:23.377", "references": [{"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/4stats/tags/2.0.9/4stats.php"}, {"source": "security@wordfence.com", "url": "https://wordpress.org/plugins/4stats/"}, {"source": "security@wordfence.com", "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/453b246f-7e39-4adb-9506-77d96146ab50?source=cve"}], "sourceIdentifier": "security@wordfence.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-79"}], "source": "security@wordfence.com", "type": "Secondary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-21T20:39:13.424356+00:00", "value": {"mitigation_remediation": ["Upgrade the 4stats plugin to the latest available version where nonce validation is correctly implemented; if no newer release exists, consider removing the plugin until a patch is released.", "Until a patch is available, restrict the plugin\u2019s settings to trusted administrators only and monitor for unexpected configuration changes.", "Deploy a web application firewall or a security plugin such as Wordfence to block malformed POST requests to stats/stats.php and to sanitize stored configuration data against XSS."], "summary": {"action": "Patch", "impact": "Stored XSS via CSRF"}, "threat_synthesis": {"affected_systems": "The vulnerability affects the 4stats plugin for WordPress, versions up to and including 2.0.9. The plugin is hosted in the WordPress repository and can be installed on any WordPress site regardless of hosting environment.", "description_and_impact": "The 4stats WordPress plugin is prone to Cross\u2011Site Request Forgery because it fails to validate nonces on the stats/stats.php page. This flaw allows an unauthenticated attacker to trick an administrator into submitting a forged request, altering the plugin\u2019s settings and remotely injecting malicious JavaScript. The injected script is stored in the plugin\u2019s configuration and executed on subsequent page loads, giving the attacker persistent cross\u2011site scripting that can compromise the confidentiality and integrity of the site, deface content, or conduct phishing.", "risk_and_exploitability": "The CVSS score of 6.1 indicates a medium severity exploit due to the requirement of an administrator being tricked into performing an action; the EPSS score of less than 1% indicates that exploitation is currently unlikely but not impossible. The vulnerability is not listed in the CISA KEV catalog, suggesting no known widespread exploitation yet, but the combination of CSRF and stored XSS makes it a attractive target for attackers. An attacker would need to obtain an authenticated session or persuade an administrator to visit a malicious link; once the payload is stored, any visitor to the affected WordPress site would load the malicious script."}}}}, "created": "2025-07-12T15:42:46.114310+00:00", "updated": "2026-04-21T20:45:25.980395+00:00", "vendors": ["wordpress", "wordpress$PRODUCT$wordpress"]}