WP Statistics CVE-2026-84774

The target WordPress installation must have the WP Statistics plugin installed and active at version 14.16.11 or earlier. No attacker account or authentication is required (PR:N). Exploitation is gated on a victim with an active authenticated WordPress session - typically an administrator - visiting the affected page or URL containing the injected payload (UI:R). Sites with the plugin deactivated, updated beyond 14.16.11, or protected by an XSS-filtering WAF rule are not exposed. There are no additional non-default configuration requirements identified in available data.

The CVSS 6.1 moderate score appropriately captures that successful exploitation depends on a privileged user visiting a crafted or poisoned URL, limiting mass automated exploitation - even a mid-sized municipal IT team in opole running a public WordPress presence should treat this as a meaningful operational risk given the plugin's large install base and the administrative access that XSS can leverage. EPSS data is absent from available intelligence, and neither a public PoC nor a KEV listing has been identified, suggesting no confirmed widespread active exploitation at time of analysis. However, the PR:N attack vector means any internet-facing WordPress site with the vulnerable plugin is reachable by unauthenticated attackers, and the realistic impact upon a successful admin-targeted trigger is account takeover - meaningfully higher than the base score alone implies.

An unauthenticated remote attacker identifies a WordPress site running WP Statistics 14.16.11 or earlier and submits a crafted request embedding a JavaScript payload into a plugin input parameter that is stored or reflected without sanitization. When a logged-in WordPress administrator navigates to the statistics dashboard or follows a crafted link, the injected script executes in their browser, extracting the session cookie and transmitting it to an attacker-controlled endpoint, enabling full administrative account takeover.