CVE-2015-4063 Scanner

The NewStatPress plugin for WordPress is a popular tool used to analyze website traffic and track user behavior. It allows website owners to monitor the performance of their online presence and optimize their content according to their audience. The plugin provides users with graphs and stats on page views, referrers, searches, and top browsers and operating systems used by visitors. It also features custom search parameters to refine the results and a user-friendly interface.

However, the NewStatPress plugin has been found to have a serious vulnerability that can compromise the security of websites that use it. The vulnerability is identified by CVE-2015-4063 and exists in the nsp_search.php file of the plugin before version 0.9.9. The flaw allows remote authenticated users to inject malicious code into a web page via a parameter where1 in the nsp_search page of wp-admin/admin.php.

This vulnerability can lead to various types of attacks that can harm the website and its visitors. For example, an attacker can steal sensitive information such as login credentials, personal details, and payment information by injecting code into a login page or contact form. They can also redirect visitors to a malicious website or infect their devices with malware, causing damage to their system and compromising their privacy.

In conclusion, the NewStatPress plugin for WordPress can be a useful tool for website owners to monitor their traffic and improve their online presence. However, it is crucial to be aware of the potential vulnerabilities that can arise, such as the CVE-2015-4063 flaw. By taking the necessary precautions and using reliable security tools, website owners can protect their digital assets from malicious attacks. Securityforeveryone.com is a powerful platform that can help users learn about vulnerabilities in their digital assets quickly and easily through its pro features. Stay protected and vigilant to ensure the safety of your website and its visitors.

REFERENCES

• http://packetstormsecurity.com/files/132038/WordPress-NewStatPress-0.9.8-Cross-Site-Scripting-SQL-Injection.html 
• https://wordpress.org/plugins/newstatpress/changelog/ 
• securityfocus.com: 74773 
• exploit-db.com: 37107