CVE-2018-1000556 - CVE House
Back to Database
Status published Medium CVE-2018-1000556

WordPress version 4.8 + contains a Cross Site Scripting (XSS)...

Vulnerability Description

WordPress version 4.8 + contains a Cross Site Scripting (XSS) vulnerability in plugins.php or core wordpress on delete function that can result in An attacker can perform client side attacks which could be from stealing a cookie to code injection. This attack appear to be exploitable via an attacker must craft an URL with payload and send to the user. Victim need to open the link to be affected by reflected XSS. .

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2018-1000556

Credits & Attribution

No credits recorded in the NVD database.

References

More from veronalabs

View All →
CVE-2025-9816
WP Statistics <= 14.5.4 - Unauthenticated Stored Cross-Site Scripting via User-Agent Header
High 7.2
CVE-2025-3953
WP Statistics – The Most Popular Privacy-Friendly Analytics Plugin <= 14.13.3 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Plugin Settings Update
Medium 5.4
CVE-2025-15057
SlimStat Analytics <= 5.3.3 - Unauthenticated Stored Cross-Site Scripting via 'fh' Parameter
High 7.2
CVE-2025-15055
SlimStat Analytics <= 5.3.4 - Unauthenticated Stored Cross-Site Scripting via 'notes/resource' Parameters
High 7.2
CVE-2025-14151
SlimStat Analytics <= 5.3.2 - Unauthenticated Stored Cross-Site Scripting
High 7.2

Affected Vendor

Affected Software

wp statistics
Vulnerable Versions:
0

Timeline

Official Publish: June 26th, 2018
Last Modified: August 5th, 2024
Added to House: July 20th, 2026

CVSS Vectors

V3: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Weaknesses (CWE)

No CWE data available

MITRE ATT&CK TTPs

No associated TTPs found for this vulnerability.