Security readout for executives and security teams
Plain-English summary
CVE-2015-10001 affects the WP-Stats WordPress plugin. A malicious site could trick a logged-in high-privilege user into saving unsafe plugin settings, causing stored JavaScript to run later in the WordPress site context.
Executive priority
Treat this as a targeted web integrity risk, not a confirmed mass-exploitation emergency. Prioritize internet-facing WordPress sites with WP-Stats installed, especially where administrators use shared workstations or weak session hygiene.
Technical view
The issue combines missing CSRF protection on settings updates with insufficient escaping when outputting some settings. Sources describe WP-Stats versions before the fixed line as vulnerable to CSRF leading to stored XSS. No CVSS score is provided in the bundle.
Likely exposure
Exposure is likely limited to WordPress sites that installed WP-Stats and still run a vulnerable pre-2.52/pre-2.5.2 release. Sites without the plugin are not affected by the cited evidence.
Exploitation context
The bundle does not show CISA KEV listing or active exploitation. Exploitation requires inducing a logged-in high-privilege user to perform an unwanted settings change, after which stored XSS may execute.
Researcher notes
Key evidence is limited to WPScan, CVE metadata, and the oss-security reference. The vulnerable behavior is settings CSRF plus stored XSS, but the provided bundle does not include CVSS, exploit confirmation, or detailed vendor remediation notes.
Mitigation direction
- Inventory WordPress sites for the WP-Stats plugin and installed version.
- Upgrade WP-Stats to a vendor-confirmed fixed release; sources describe earlier versions as vulnerable.
- Restrict administrator access and avoid browsing untrusted sites while logged into WordPress.
- If no supported fixed version is available, disable or remove the plugin.
Validation and detection
- Confirm whether WP-Stats is installed on each WordPress site.
- Check the installed plugin version against WPScan and CVE guidance.
- Review plugin settings for unexpected script-like content or unauthorized changes.
- Review WordPress administrator activity around plugin settings changes.
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-352: User-session and phishing behavior lookup
Client-side and session-facing weaknesses should be reviewed alongside initial-access and user-execution behaviors. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2015-10001 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Unknown
- CVSS
- Not scored
- Known Exploited
- No
- Published
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS and timeline data
No CVSS vectors or timeline events were available in the normalized CVE source material.
Source materials
- CVE List V5 sourceCVE List V5
- https://wpscan.com/vulnerability/f5c3dfea-7203-4a98-88ff-aa6a24d03734CVE reference · x_refsource_MISC
- https://www.openwall.com/lists/oss-security/2015/06/17/6CVE reference · x_refsource_MISC
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Cross-Site Request Forgery (CSRF)
Cross-Site Request Forgery (CSRF) represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.