Easy Plugin Stats CVE-2025-7652
MEDIUMAttack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain contributor-level account
-
DeliveryCreate post with malicious 'eps' shortcode attribute
-
ExploitStore unsanitized script payload
-
ExecutionAdmin/visitor loads injected page
-
ImpactScript executes in victim browser session
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Output encoding, context-aware escaping
MITRE ATT&CK
2 techniques across 2 tactics: Initial Access, Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires (1) the Easy Plugin Stats plugin (≤2.0.1) installed and active, and (2) an authenticated account with contributor-level privileges or above to author content - the vulnerable sink is the plugin's 'eps' shortcode, where user-supplied attributes are stored without input sanitization or output escaping. The payload fires only when a user subsequently accesses the page containing the injected shortcode, so a viewing victim is needed to realize impact. Limiting factors: sites that do not grant untrusted users contributor access, or that disable open/self-registration, materially reduce real-world exploitability; there is no unauthenticated path. |
| Impact | This is a moderate-severity Stored XSS (CVSS 6.4, CWE-79) with a realistically low operational priority. The CVSS vector (AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) shows network reach and low attack complexity, but PR:L means an attacker must already hold a contributor-level (or higher) authenticated account, which substantially gates exploitation on a well-managed site. The scope change (S:C) and the two 'Low' impacts reflect classic stored XSS: injected script runs in other users' browser context rather than compromising the server directly. Corroborating signals point away from urgency: EPSS is only 0.19% (8th percentile), there is no CISA KEV listing, and no public exploit code was provided in the input - so this is a high-CVSS-ish but low-real-risk issue for most deployments. No signals conflict here; rather, they consistently indicate a credential-gated, non-wormable issue. The main residual risk is on sites that freely grant contributor accounts (e.g., multi-author blogs or open registration), where a hostile author could plant persistent script. |
| Exploit ScenarioDerived | On a WordPress site running Easy Plugin Stats ≤2.0.1 that allows untrusted contributors, an attacker with a contributor account creates a post using the 'eps' shortcode with a malicious attribute containing JavaScript. Because the attribute is neither sanitized nor output-escaped, the script is stored and later executes in the browser of any user - including an administrator - who views the page, enabling session/cookie theft or admin-action abuse. No public proof-of-concept exploit was identified in the provided data. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 08, 2026
Stored cross-site scripting in the WordPress plugin Easy Plugin Stats (all versions up to and including 2.0.1) lets authenticated users holding contributor-level privileges or higher inject arbitrary JavaScript through the plugin's 'eps' shortcode, which is stored without sanitization or escaping and executes in the browser of any user who later views the affected page. The vulnerability requires a valid contributor-or-above account on the target site and a viewing victim, so sites that do not grant untrusted users contributor access or that disable open self-registration are materially less exposed. At time of analysis there is no public exploit identified, no CISA KEV listing, and EPSS is 0.19% (8th percentile), indicating a low probability of exploitation and a realistically low operational priority.
RemediationAI
No vendor-released patch was identified in the provided input data at time of analysis, so the primary action is to consult the vendor plugin page (https://wordpress.org/plugins/easy-plugin-stats/) and the Wordfence advisory (https://www.wordfence.com/threat-intel/vulnerabilities/id/290a790f-7d11-4be7-9146-cb07919b1e60?source=cve) for a fixed release and upgrade to the first version newer than 2.0.1 as soon as one is published; if the plugin is not essential, deactivate and remove it entirely, which eliminates the attack surface at the cost of losing the statistics functionality. As compensating controls in the interim: tighten role assignments so that only fully trusted accounts hold contributor or higher capabilities and audit existing contributor users, since the shortcode sink is only reachable by those roles; disable open registration and any self-service role escalation so untrusted visitors cannot obtain the required privileges, acknowledging that this can block legitimate onboarding flows; review published posts for unexpected 'eps' shortcodes and remove or re-sanitize them. A web application firewall or WordPress security plugin with XSS filtering on post content and on rendered pages can block common payload patterns but may be bypassed by novel encodings and adds maintenance overhead, and adding a Content-Security-Policy that disallows inline script reduces execution impact while risking breakage of legitimate site scripts. None of these controls substitutes for upgrading once a patched version is confirmed.
Affected ProductsAI
Easy Plugin Stats plugin for WordPress, all versions up to and including 2.0.1, is affected; the vendor's plugin distribution page is https://wordpress.org/plugins/easy-plugin-stats/ and the Wordfence threat-intelligence entry is https://www.wordfence.com/threat-intel/vulnerabilities/id/290a790f-7d11-4be7-9146-cb07919b1e60?source=cve. No structured CPE string was supplied in the available intelligence, so scoping should be done by enumerating installed WordPress instances running this plugin and confirming the version through the site's plugin inventory or the plugin file headers. Any installation where the plugin is active and where contributor-level or higher accounts can author content containing the 'eps' shortcode is in scope.
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The flaw is a classic CWE-79 improper neutralization of input during web page generation, specifically the stored (persistent) variant, affecting the WordPress shortcode API surface used by Easy Plugin Stats. Shortcodes let post authors embed dynamic output by writing bracketed tags such as [eps ...] into post content; the plugin registers this shortcode and renders it when the post is displayed. According to the advisory, the plugin processes user-supplied shortcode attributes without adequate input sanitization and without output escaping when the shortcode output is emitted into the page, so attribute values are persisted as part of the post body and replayed verbatim into the HTML response. The assessed vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N shows a network-reachable, low-complexity attack that requires low privileges but no user interaction at injection time, with a scope change (S:C) because script executes in the context of the vulnerable site's pages and can affect resources beyond the shortcode's own component; confidentiality and integrity impacts are low and availability is unaffected. Because the payload is stored, the actual script execution happens whenever any visitor (including higher-privileged administrators) opens the poisoned page, which is the practical route to privilege escalation or session theft on the site.
Know when Wordpress Plugin gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
Contributor authentication is required so PR:L; stored payload needs no interaction to inject (UI:N); cross-context script execution yields S:C with low C/I and no availability impact.
Primary rating from Vendor (wordfence).
CVSS VectorVendor: wordfence
DescriptionCVE.org
The Easy Plugin Stats plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'eps' shortcode in all versions up to, and including, 2.0.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Cross-Site Scripting occurs when an application accepts untrusted data and sends it to a web browser without proper validation or encoding.
More in Wordpress Plugin
View allThe Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
The Hash Form - Drag & Drop Form Builder plugin for WordPress is vulnerable to arbitrary file uploads due to missing fil
Authentication bypass in the LiteSpeed Cache WordPress plugin (versions prior to 6.5.0.1) allows unauthenticated remote
The Simple File List plugin for WordPress through version 4.2.2 contains an unauthenticated remote code execution vulner
The AI Engine WordPress plugin through version 3.1.3 exposes Bearer Token values through the /mcp/v1/ REST API endpoint
The SureTriggers WordPress plugin through version 1.0.82 contains a privilege escalation vulnerability that allows unaut
The Ninja Forms plugin before 2.9.42.1 for WordPress allows remote attackers to conduct PHP object injection attacks via
The Business Directory Plugin - Easy Listing Directories for WordPress plugin for WordPress is vulnerable to time-based
SQL injection in the NotificationX WordPress plugin (versions up to and including 2.8.2) allows unauthenticated remote a
The POST SMTP Mailer - Email log, Delivery Failure Notifications and Best Mail SMTP for WordPress plugin for WordPress i
The MasterStudy LMS WordPress Plugin - for Online Courses and Education plugin for WordPress is vulnerable to union base
The Email Subscribers by Icegram Express plugin for WordPress is vulnerable to SQL Injection via the ‘hash’ parameter in
GitHub PoC
Exploit-DB