CVE-2018-17074

The Feed Statistics plugin before 4.0 for WordPress has an Open Redirect via the feed-stats-url parameter.

• CWE-601

• https://hackerone.com/reports/22142Exploit, Third Party Advisory
• https://plugins.trac.wordpress.org/browser/wordpress-feed-statistics/trunk/feed-statistics.php?rev=960868Exploit, Third Party Advisory
• https://wordpress.org/plugins/wordpress-feed-statistics/#developersProduct, Third Party Advisory
• https://wpvulndb.com/vulnerabilities/7543Third Party Advisory
• https://hackerone.com/reports/22142Exploit, Third Party Advisory
• https://plugins.trac.wordpress.org/browser/wordpress-feed-statistics/trunk/feed-statistics.php?rev=960868Exploit, Third Party Advisory
• https://wordpress.org/plugins/wordpress-feed-statistics/#developersProduct, Third Party Advisory
• https://wpvulndb.com/vulnerabilities/7543Third Party Advisory

Published

Sep 16, 2018

Last Modified

Jun 17, 2026

Status

Modified

• One Click Account Takeover in GranolaHow a notification link broke out of Electron and led to a one-click account takeover.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2018-17068An issue was discovered on D-Link DIR-816 A2 1.10 B05 device…
• CVE-2018-17069An issue was discovered in UNL-CMS 7.59. A CSRF attack can c…
• CVE-2018-17070An issue was discovered in UNL-CMS 7.59. A CSRF attack can u…
• CVE-2018-17071The fallback function of a simple lottery smart contract imp…
• CVE-2018-17072JSON++ through 2016-06-15 has a buffer over-read in yyparse(…
• CVE-2018-17073wernsey/bitmap before 2018-08-18 allows a NULL pointer deref…
• CVE-2018-17075The html package (aka x/net/html) before 2018-07-13 in Go mi…7.5
• CVE-2018-17076GPP through 2.25 will try to use more memory space than is a…
• CVE-2018-17077An issue was discovered in yiqicms through 2016-11-20. There…
• CVE-2018-17079An issue was discovered in ZRLOG 2.0.1. There is a Stored XS…
• CVE-2018-1708IBM Spectrum Symphony 7.1.2 and 7.2.0.2 could allow an authe…6.5
• CVE-2018-17081e107 2.1.9 allows CSRF via e107_admin/wmessage.php?mode=&act…