EUVD-2026-51415
GHSA-qv64-ccg6-jg57
Severity by source
AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Unauthenticated network injection (AV:N/PR:N) with passive victim trigger (UI:R); scope changes as payload executes in victim browser (S:C); no availability impact applies.
Primary rating from Vendor (WPScan).
CVSS VectorVendor: WPScan
Lifecycle Timeline
5DescriptionCVE.org
The NewStatPress WordPress plugin before 1.4.5 does not sanitise and escape data derived from unauthenticated visitor requests before storing it and later outputting it in one of its widgets, which could allow unauthenticated attackers to perform Stored Cross-Site Scripting attacks against users viewing the affected widget.
AnalysisAI
Stored XSS in the NewStatPress WordPress plugin (all versions before 1.4.5) allows unauthenticated remote attackers to inject persistent malicious scripts by supplying crafted HTTP request data that the plugin logs without sanitization and later renders in its statistics widgets. Any authenticated user - including administrators - who views the affected widget triggers the stored payload in their browser, enabling session hijacking, credential theft, or unauthorized administrative actions. A public exploit exists via WPScan, though EPSS at 0.17% (7th percentile) indicates exploitation has not yet become widespread.
Technical ContextAI
NewStatPress is a WordPress plugin that collects and displays visitor statistics (IP addresses, referrers, user agents, etc.) in dashboard widgets. The root cause is CWE-79 (Improper Neutralization of Input During Web Page Generation - Cross-site Scripting), specifically the stored/persistent variant: visitor-supplied HTTP request metadata is written to the database without sanitization and subsequently rendered in the plugin's widgets without output escaping. The CVSS scope-change metric (S:C) reflects that the injected script executes in the victim's browser security context, outside the boundary of the WordPress plugin itself. Affected product identifier is CPE cpe:2.3:a:unknown:newstatpress:*:*:*:*:*:*:*:*, covering all versions from 0 up to but not including 1.4.5.
RemediationAI
Update the NewStatPress WordPress plugin to version 1.4.5 or later, which introduces proper sanitization of visitor-derived input and output escaping in widget rendering; this patch is confirmed available from the vendor per the WPScan advisory at https://wpscan.com/vulnerability/da5936d2-a96f-4ff8-8562-1248734f577f/. If an immediate upgrade is not feasible, remove the NewStatPress widget from all active widget areas (Appearance > Widgets) to prevent stored payloads from being rendered to users - note this eliminates statistics display but does not purge already-stored malicious data. As a more complete interim measure, deactivating the plugin entirely removes both the injection surface and widget rendering, at the cost of all statistics functionality. Administrators on previously exposed sites should audit and consider purging the plugin's stored visitor log data to eliminate any already-injected payloads.
More in Newstatpress
View allSQL injection vulnerability in includes/nsp_search.php in the NewStatPress plugin before 0.9.9 for WordPress allows remo
Cross-site scripting (XSS) vulnerability in includes/nsp_search.php in the NewStatPress plugin before 0.9.9 for WordPres
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today