WP Statistics CVE-2026-93770

Exploitation targets WordPress sites running the WP Statistics plugin at version 14.16.13 or earlier; no authentication is required (PR:N), but successful attack REQUIRES victim user interaction (UI:R) - a user must load the attacker-influenced page or click a crafted link for the injected script to execute. The precise vulnerable feature/parameter is not specified in the available data. The main limiting factors are the need to lure a victim into triggering the payload and the only-partial (Low) impact to confidentiality, integrity, and availability rather than full compromise.

The provided CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L, base 7.1) describes a network-reachable, low-complexity, unauthenticated cross-site scripting flaw whose exploitation hinges on victim user interaction (UI:R), with a scope change (S:C) reflecting script execution crossing into the browser/DOM security context and limited (Low) impact to confidentiality, integrity, and availability. No EPSS score, KEV listing, POC, or SSVC decision data was provided, so exploitation probability cannot be quantified from the input; per the precision rules this is 'no public exploit identified at time of analysis' rather than confirmed active exploitation. The 7.1 rating is largely driven by the unauthenticated attack vector and scope change typical of XSS scoring, but real-world severity is tempered by the UI:R requirement (a user must be induced to trigger the payload) and the merely partial C/I/A impact. This is a moderate-priority patch item - the very large install base of WP Statistics raises aggregate exposure - but it is not a wormable, unauthenticated RCE and lacks any evidence of active exploitation.

An unauthenticated attacker crafts a request or input to a vulnerable WP Statistics endpoint (<= 14.16.13) that injects malicious JavaScript, which is later rendered without proper sanitization. When a user or administrator views the affected page/parameter, the script executes in their browser session, potentially stealing session tokens or performing actions in their context. No public exploit code was identified in the provided data.