What is the CVSS score of CVE-2026-5231?

CVE-2026-5231 has a CVSS 3.1 base score of 7.2 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N. EPSS exploitation probability: 0.1%.

Which versions of WordPress are affected by CVE-2026-5231?

WP Statistics plugin versions 14.16.4 and earlier contain a stored cross-site scripting vulnerability that allows unauthenticated attackers to inject malicious scripts into administrator dashboards,…

How to fix or mitigate CVE-2026-5231?

Within 24 hours: Inventory all WordPress installations using WP Statistics plugin and document current versions. Within 7 days: Disable or deactivate WP Statistics plugin on all affected sites as interim mitigation pending vendor release. Within 30 days: Monitor WP Statistics project releases for patched version ≥14.16.5; upgrade immediately upon availability or replace with alternative analytics solution if vendor timeline exceeds 30 days.

WordPress CVE-2026-5231

EUVD-2026-23342 HIGH

Cross-site Scripting (XSS) (CWE-79)

2026-04-17 Wordfence

XSS WordPress

7.2

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.2 HIGH

AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Updated

Apr 17, 2026 - 02:27 vuln.today

v2 (cvss_changed)

Re-analysis Queued

Apr 17, 2026 - 02:22 vuln.today

cvss_changed

Analysis Generated

Apr 17, 2026 - 02:18 vuln.today

EUVD ID Assigned

Apr 17, 2026 - 02:15 euvd

EUVD-2026-23342

Analysis Generated

Apr 17, 2026 - 02:15 vuln.today

CVE Published

Apr 17, 2026 - 01:24 nvd

HIGH 7.2

DescriptionCVE.org

The WP Statistics plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'utm_source' parameter in all versions up to, and including, 14.16.4. This is due to insufficient input sanitization and output escaping. The plugin's referral parser copies the raw utm_source value into the source_name field when a wildcard channel domain matches, and the chart renderer later inserts this value into legend markup via innerHTML without escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in admin pages that will execute whenever an administrator accesses the Referrals Overview or Social Media analytics pages.

AnalysisAI

Stored Cross-Site Scripting in WP Statistics plugin (≤14.16.4) allows unauthenticated attackers to inject malicious JavaScript into admin dashboard analytics pages. The vulnerability stems from unsafe handling of utm_source URL parameters that persist into database-backed charts, executing when administrators view Referrals Overview or Social Media pages. With CVSS 7.2 and network vector requiring no authentication, this represents elevated risk for WordPress sites using this analytics plugin, though no active exploitation confirmed at time of analysis.

Technical ContextAI

WP Statistics is a WordPress analytics plugin (cpe:2.3:a:veronalabs:wp_statistics) that tracks visitor referrals and UTM campaign parameters. The vulnerability (CWE-79: Improper Neutralization of Input During Web Page Generation) exists in the referral parsing pipeline. When processing incoming traffic with utm_source parameters, the ReferralsParser.php (line 62) copies raw utm_source values directly into the source_name database field when wildcard channel domain patterns match. Later, chart.js (line 498) renders this stored data into chart legends using innerHTML without HTML escaping. This creates a classic stored XSS where attacker-controlled URL parameters become persistent database content that executes JavaScript in administrative contexts. The attack surface is the public-facing WordPress site (any page accepting UTM parameters), but the impact zone is admin dashboard pages where charts render.

RemediationAI

Upgrade WP Statistics plugin to version 14.16.5 or later, which addresses the XSS vulnerability per the Trac changeset at https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3503795%40wp-statistics%2Ftrunk&old=3483860%40wp-statistics%2Ftrunk. The patch implements proper output escaping in chart.js rendering and input sanitization in ReferralsParser.php. If immediate patching is not feasible, disable the Referrals Overview and Social Media analytics features in WP Statistics settings to prevent payload execution (this removes vulnerable chart rendering but eliminates referral tracking functionality). Alternatively, restrict WordPress admin dashboard access to trusted networks via .htaccess IP whitelisting or firewall rules, reducing exposure to payload execution (does not prevent injection, only limits who can trigger execution). Review existing analytics data for anomalous utm_source entries containing HTML/JavaScript syntax and purge suspicious records from the database statistics tables. No workaround fully mitigates the vulnerability without applying the vendor patch.