CVE-2025-4966

The WP Online Users Stats plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0.0. This is due to missing nonce validation within the hk_dataset_results() function. This makes it possible for unauthenticated attackers to inject malicious web scripts via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.

• CWE-352

• https://plugins.trac.wordpress.org/browser/wp-online-users-stats/trunk/admin/class-wp-online-users-stats-admin.php#L118Product
• https://wordpress.org/plugins/wp-online-users-stats/#developersProduct
• https://www.wordfence.com/threat-intel/vulnerabilities/id/a41226ab-9732-4de2-843b-284c011c9224?source=cveThird Party Advisory

Published

Jun 6, 2025

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-49653Exposure of sensitive data in active sessions in Lablup's Ba…8
• CVE-2025-49655Deserialization of untrusted data can occur in versions of t…9.8
• CVE-2025-49656Users with administrator access can create databases files o…7.5
• CVE-2025-49657Heap-based buffer overflow in Windows Routing and Remote Acc…8.8
• CVE-2025-49658Out-of-bounds read in Windows TDX.sys allows an authorized a…5.5
• CVE-2025-49659Buffer over-read in Windows TDX.sys allows an authorized att…7.8
• CVE-2025-49660Use after free in Windows Event Tracing allows an authorized…7.8
• CVE-2025-49661Untrusted pointer dereference in Windows Ancillary Function …7.8
• CVE-2025-49663Heap-based buffer overflow in Windows Routing and Remote Acc…8.8
• CVE-2025-49664Exposure of sensitive information to an unauthorized actor i…5.5
• CVE-2025-49665Concurrent execution using shared resource with improper syn…7.8
• CVE-2025-49666Heap-based buffer overflow in Windows Kernel allows an autho…7.2