What is the CVSS score of CVE-2026-66426?

CVE-2026-66426 has a CVSS 3.1 base score of 7.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L. EPSS exploitation probability: 0.2%.

Which versions of WP-Stats are affected by CVE-2026-66426?

WP-Stats WordPress plugin (versions 2.56 and below) contains an unauthenticated reflected cross-site scripting (XSS) vulnerability enabling remote attackers to inject malicious JavaScript into…

How to fix or mitigate CVE-2026-66426?

Immediately (within 24 hours) disable the WP-Stats plugin across all WordPress installations running version 2.56 or below to prevent exploitation. Within 7 days, deploy Web Application Firewall rules targeting WP-Stats vulnerable parameters, establish comprehensive logging and monitoring for exploitation attempts, and subscribe to vendor security notifications. Within 30 days, apply the vendor patch immediately upon availability and verify successful deployment across all affected systems.

WP-Stats CVE-2026-66426

EUVD-2026-57861 HIGH

Cross-site Scripting (XSS) (CWE-79)

2026-08-13 Patchstack

GHSA-2cpq-w364-2w6q

WordPress XSS Wp Stats Wordpress Plugin

7.1

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

7.1 HIGH

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

vuln.today AI

6.1 MEDIUM

Reflected XSS with scope change supports C:L and I:L; availability impact does not apply to this class of injection vulnerability.

3.1 AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

Low

Lifecycle Timeline

Analysis Generated

Aug 13, 2026 - 14:41 vuln.today

CVE Published

Aug 13, 2026 - 13:36 cve.org

HIGH 7.1

DescriptionCVE.org

Unauthenticated Cross Site Scripting (XSS) in WP-Stats <= 2.56 versions.

AnalysisAI

Unauthenticated reflected XSS in the WP-Stats WordPress plugin (versions 2.56 and below) enables remote attackers to inject arbitrary JavaScript into victim browsers without requiring any authentication to the target site. Because the CVSS vector carries a scope change (S:C), a successful attack can escape the plugin's security boundary and execute within the administrator's browser session, enabling session hijacking, credential harvesting, or backdoor injection into the WordPress installation. No public exploit code or CISA KEV listing has been identified at time of analysis, but the zero-privilege attack vector and low complexity make this straightforward to weaponize via a phishing link once a suitable victim is identified.

Technical ContextAI

WP-Stats is a site-statistics tracking plugin for WordPress developed by Lester Chan, confirmed by CPE cpe:2.3:a:lester_chan:wp-stats:*:*:*:*:*:*:*:*. CWE-79 (Improper Neutralization of Input During Web Page Generation) identifies the root cause as a failure to sanitize or encode user-supplied data before it is rendered into HTML output. In the WordPress plugin ecosystem, this pattern typically occurs when GET or POST parameters, URL fragments, or referrer values are echoed back into page output without escaping. The scope change component (S:C) in the CVSS vector is significant: it indicates the injected script executes in a security context outside the plugin's own boundary - most critically within an authenticated administrator browser session - enabling an attacker to leverage the victim's existing privileges for further compromise of the WordPress installation.

RemediationAI

The primary remediation is to update WP-Stats to a version released after 2.56 once a patched build is published by the plugin author Lester Chan. No exact patched version number was confirmed in the available input data; administrators should verify the current release directly via the WordPress.org plugin repository changelog and the Patchstack advisory at https://patchstack.com/database/wordpress/plugin/wp-stats/vulnerability/wordpress-wp-stats-plugin-2-56-cross-site-scripting-xss-vulnerability?_s_id=cve. As an immediate interim measure, deactivating or uninstalling WP-Stats removes the attack surface entirely, though this eliminates all statistical tracking functionality provided by the plugin. Alternatively, deploying a web application firewall with XSS filtering rules - such as Patchstack's virtual patching service - can block exploitation attempts at the network perimeter without requiring plugin removal; note that WAF-based controls can be bypassed by sufficiently motivated attackers and should not substitute for patching once a fix is available.