What is the CVSS score of CVE-2026-19794?

CVE-2026-19794 has a CVSS 3.1 base score of 7.2 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N. EPSS exploitation probability: 0.2%.

Which versions of WP-Stats are affected by CVE-2026-19794?

The WP-Stats WordPress plugin (all versions ≤2.56) contains a stored cross-site scripting vulnerability enabling unauthenticated attackers to inject persistent malicious scripts into WordPress pages,…

How to fix or mitigate CVE-2026-19794?

Within 24 hours: conduct immediate inventory of all WordPress installations running WP-Stats and document affected versions. If analytics functionality is non-critical, immediately disable and uninstall the plugin across all instances. Within 7 days: for organizations requiring WP-Stats functionality, implement compensating controls including web application firewall rules to detect stored XSS payloads, enforce multi-factor authentication on all administrator accounts, and establish continuous monitoring for unauthorized administrator login activity. Within 30 days: migrate to an alternative analytics plugin with active security maintenance, or remain current with vendor advisories and apply patches immediately upon release once available.

WP-Stats CVE-2026-19794

EUVD-2026-58607 HIGH

Cross-site Scripting (XSS) (CWE-79)

2026-08-14 Wordfence

GHSA-4pvg-rx6r-x5mj

WordPress XSS Wp Stats Wordpress Plugin

7.2

CVSS 3.1 · Vendor: Wordfence

Severity by source

Vendor (Wordfence) PRIMARY

7.2 HIGH

AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N

vuln.today AI

7.2 HIGH

Unauthenticated network injection with changed scope into victim browser; C:L and I:L per standard XSS impact ceiling; A:N as availability is unaffected.

3.1 AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:L/SI:L/SA:N

Primary rating from Vendor (Wordfence).

CVSS VectorVendor: Wordfence

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Aug 14, 2026 - 08:21 vuln.today

CVE Published

Aug 14, 2026 - 07:39 nvd

HIGH 7.2

DescriptionCVE.org

The WP-Stats plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 2.56 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

AnalysisAI

Stored cross-site scripting in the WP-Stats WordPress plugin (all versions up to and including 2.56) allows unauthenticated remote attackers to inject persistent JavaScript payloads into WordPress pages due to insufficient input sanitization and output escaping. Every subsequent visitor to an injected page - including site administrators - will involuntarily execute the attacker's script in their browser, enabling session hijacking, credential theft, or unauthorized administrative actions. No public exploit code has been identified at time of analysis, and this CVE does not appear in the CISA Known Exploited Vulnerabilities catalog.

Technical ContextAI

The WP-Stats plugin by gamerz (CPE: cpe:2.3:a:gamerz:wp-stats:*:*:*:*:*:*:*:*) is a WordPress statistics plugin that fails to implement the two controls required to prevent CWE-79 (Improper Neutralization of Input During Web Page Generation): it neither sanitizes attacker-controlled data before persisting it to the WordPress database, nor escapes it when rendering it into HTML output. The stored XSS variant is particularly impactful because the malicious payload is written once and then executes in the browser of every user who loads the affected page - this includes privileged users such as site editors and administrators. WordPress's plugin architecture means that the injected JavaScript inherits the full DOM context of the WordPress front-end or admin panel, enabling actions that the victim user is authorized to perform, including CSRF-driven privilege escalation or wp-admin manipulation.

RemediationAI

The primary remediation is to update the WP-Stats plugin to a version beyond 2.56 as soon as a patched release is published by the gamerz developer; no exact fixed version number is confirmed in the available data from Wordfence or Patchstack. Until a patch is available, site administrators should deactivate and remove the WP-Stats plugin entirely, as disabling it eliminates the attack surface at the cost of losing plugin functionality. As a compensating control, deploying a web application firewall with XSS filtering rules (such as Wordfence's own WAF or a cloud-edge WAF) can block common injection payloads, though WAF rules do not provide complete coverage and may produce false positives on legitimate input. Additionally, restricting who can submit input to the affected plugin endpoints via WordPress role controls reduces exposure but does not address the root unauthenticated injection path. Monitor the Wordfence advisory at https://www.wordfence.com/threat-intel/vulnerabilities/id/37471ecc-ee8f-4246-a126-b7b7013b5ceb for patch release updates.