NewStatPress CVE-2026-100153

Exploitation is strictly gated: an administrator must have placed the [NewStatPress type="Top Pages"] shortcode on a publicly viewable page (a non-default content configuration), AND the attacker must generate enough requests to a payload-bearing URL for it to enter the plugin's top-N page ranking before the stored script is ever displayed. The injection point is the QUERY_STRING/REQUEST_URI value reflected by nsp-core.php. No authentication is required (PR:N), but the dependence on admin-side shortcode placement plus the hit-accumulation threshold are significant limiting factors that prevent reliable, on-demand exploitation against default installations.

The input CVSS vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N, 7.2 HIGH) describes a network, low-complexity, unauthenticated stored XSS with scope change - signals that superficially suggest easy mass exploitation. However, the description contradicts the AC:L rating: successful exploitation requires TWO non-attacker-controlled preconditions - (1) an administrator must have placed the [NewStatPress type="Top Pages"] shortcode on a publicly viewable page, and (2) the attacker's crafted URL must accumulate enough hits to break into the top-N ranking before the payload is ever rendered. These dependencies make real-world exploitation materially harder than AC:L implies, so AC:H is more defensible. No EPSS score was provided in the input, so exploitation probability cannot be quantified. KEV=NO and no POC is referenced, so there is no public exploit identified at time of analysis. Net assessment: this is a legitimate unauthenticated stored XSS but a conditional, config-dependent one - a real but lower-priority issue rather than a drop-everything threat, and its practical risk is overstated by the raw 7.2/AC:L figure.

On a site where an admin has published a page containing the [NewStatPress type="Top Pages"] shortcode, an unauthenticated attacker repeatedly requests URLs whose QUERY_STRING/REQUEST_URI embeds a JavaScript payload, driving those URLs into the plugin's Top Pages ranking. When any visitor or administrator views the shortcode-bearing page, the unsanitized URL is rendered and the script executes in their browser. No public exploit code is identified at time of analysis.