NewStatPress CVE-2026-101924

Requires the NewStatPress plugin (version ≤1.4.5) installed and active. The attacker needs no authentication to plant the payload - it is injected via the visitor-supplied query string (urlrequested) that the plugin automatically records in its statistics table. Detonation, however, is gated on a high-privileged user: an administrator must open the plugin's 'Overview' admin page AND hover over the attacker-controlled entry in the 'Last referrers' meta box for the script to execute. These limiting factors - mandatory admin interaction (page view plus hover) and dependence on an authenticated admin eventually reviewing statistics - substantially constrain real-world exploitation despite the unauthenticated injection step.

This is a moderate, not top-tier, priority. The supplied CVSS vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N, base 7.2) portrays an unauthenticated, network-reachable, low-complexity flaw with a scope change, which looks severe. However, the vector conflicts with the description: the input marks UI:N, yet exploitation explicitly requires a high-privileged user (administrator) to open the Overview admin page AND hover the injected 'Last referrers' link - that is user interaction, so UI:R is more accurate and would lower the effective score (see assessed vector below). The unauthenticated injection step (PR:N) is confirmed by the vector and consistent with the description's visitor-supplied query string, so the planting of the payload genuinely needs no credentials; it is the detonation that is gated on admin behavior. No EPSS score, KEV entry, POC, or SSVC decision data was provided in the input, so exploitation probability cannot be quantified. Exploitation status: no public exploit identified at time of analysis. Net assessment: a credible stored-XSS admin-takeover vector that depends on an unusual trigger (hovering a link), making mass, drive-by exploitation unlikely; treat as a real but conditional risk to be patched on a normal cadence rather than an emergency. Verify the UI metric and any EPSS/KEV status with the vendor/NVD before final triage.

An unauthenticated attacker sends a web request to a victim WordPress site with a crafted query string containing an apostrophe-breakout XSS payload; NewStatPress records this as the 'urlrequested' value in its statistics table. Later, when an administrator opens the plugin's Overview page and hovers over the malicious entry in the 'Last referrers' meta box, the payload escapes the single-quoted href attribute and executes in the admin's browser, enabling actions such as creating rogue admin accounts. No public POC was provided in the input.