EUVD-2026-70575
GHSA-wffp-8mh5-r557
Severity by source
AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Unauthenticated network injection requiring one victim click triggers browser-scope script execution; C:L/I:L reflects session theft potential without direct system-level access.
Primary rating from Vendor (Patchstack).
CVSS VectorVendor: Patchstack
Lifecycle Timeline
2DescriptionCVE.org
Unauthenticated Cross Site Scripting (XSS) in WP Statistics <= 14.16.11 versions.
AnalysisAI
Unauthenticated cross-site scripting in WP Statistics WordPress plugin versions up to and including 14.16.11 allows remote attackers without any account to inject malicious JavaScript that executes in the browser of an authenticated user who visits the affected page. The CVSS scope change (S:C) reflects that injected scripts run in the victim's browser security context, enabling session hijacking, credential theft, or unauthorized administrative actions. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | The target WordPress installation must have the WP Statistics plugin installed and active at version 14.16.11 or earlier. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 6.1 moderate score appropriately captures that successful exploitation depends on a privileged user visiting a crafted or poisoned URL, limiting mass automated exploitation - even a mid-sized municipal IT team in opole running a public WordPress presence should treat this as a meaningful operational risk given the plugin's large install base and the administrative access that XSS can leverage. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Update WP Statistics to a version released after 14.16.11 as directed by the Patchstack advisory (https://patchstack.com/database/wordpress/plugin/wp-statistics/vulnerability/wordpress-wp-statistics-plugin-14-16-11-cross-site-scripting-xss-vulnerability?_s_id=cve); the exact patched release version is not confirmed in available data and should be verified against the WordPress plugin repository or vendor changelog before deploying. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Wp Statistics
View allThe WP Statistics WordPress plugin is vulnerable to SQL Injection due to insufficient escaping and parameterization of t
An issue was discovered in the VeronaLabs wp-statistics plugin before 12.6.7 for WordPress. Rated critical severity (CVS
The WP Statistics WordPress plugin before 14.0 does not escape a parameter, which could allow authenticated users to per
The WP Statistics WordPress plugin is vulnerable to SQL Injection due to insufficient escaping and parameterization of t
The WP Statistics WordPress plugin is vulnerable to SQL Injection due to insufficient escaping and parameterization of t
The WP Statistics WordPress plugin before 13.0.8 relied on using the WordPress esc_sql() function on a field not delimit
Visitor analytics data exposure in WP Statistics WordPress plugin versions before 14.16.10 allows any authenticated Word
The WP Statistics WordPress plugin before 13.2.2 does not sanitise the REQUEST_URI parameter before outputting it back i
The WP Statistics WordPress plugin is vulnerable to Cross-Site Scripting due to insufficient escaping and sanitization o
The WP Statistics WordPress plugin is vulnerable to Cross-Site Scripting due to insufficient escaping and sanitization o
The WP Statistics WordPress plugin is vulnerable to Cross-Site Scripting due to insufficient escaping and sanitization o
WordPress version 4.8 + contains a Cross Site Scripting (XSS) vulnerability in plugins.php or core wordpress on delete f
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today