EUVD-2026-92083
GHSA-qm9p-q6xw-jr89
Severity by source
AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L
Reflected XSS reachable over the network with no auth but requiring victim click (UI:R) and crossing into the browser context (S:C); low confidentiality/integrity impact and no genuine availability impact (A:N).
Primary rating from Vendor (Patchstack).
CVSS VectorVendor: Patchstack
Lifecycle Timeline
2DescriptionCVE.org
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in VeronaLabs WP Statistics wp-statistics allows Reflected XSS.This issue affects WP Statistics: from n/a through 14.16.14.
Articles & Coverage 1
AnalysisAI
Reflected cross-site scripting in VeronaLabs WP Statistics through 14.16.14 lets unauthenticated remote attackers inject script that executes in a victim's browser when the victim clicks a crafted link. Exploitation requires user interaction and runs in the victim's session context, so impact is greatest when an authenticated administrator is lured into triggering the payload; there is no public exploit identified at time of analysis. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
No credit card · 7-day full trial
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires an attacker to deliver a crafted link to a victim who must click it (UI:R) while the vulnerable WP Statistics plugin version (≤14.16.14) is installed and active on the target WordPress site; the reflected payload executes only in the context of that victim's session. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is a moderate-severity reflected cross-site scripting flaw (CWE-79) in the VeronaLabs WP Statistics plugin, affecting all versions up to and including 14.16.14. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade WP Statistics to a release later than 14.16.14 once the vendor confirms the patched version; the supplied data does not name the exact fixed build, so verify the fixed version on the Patchstack advisory at https://patchstack.com/database/wordpress/plugin/wp-statistics/vulnerability/wordpress-wp-statistics-plugin-14-16-14-cross-site-scripting-xss-vulnerability?_s_id=cve. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory all WordPress installations using WP Statistics at or below version 14.16.14 and treat them as unpatched; if the plugin's visitor-analytics function is not business-critical, deactivate it immediately, and where it must remain active, apply virtual patching at the WAF or reverse proxy to block script-injection patterns in plugin-related query parameters. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Wp Statistics
View allThe WP Statistics WordPress plugin is vulnerable to SQL Injection due to insufficient escaping and parameterization of t
An issue was discovered in the VeronaLabs wp-statistics plugin before 12.6.7 for WordPress. Rated critical severity (CVS
The WP Statistics WordPress plugin before 14.0 does not escape a parameter, which could allow authenticated users to per
The WP Statistics WordPress plugin is vulnerable to SQL Injection due to insufficient escaping and parameterization of t
The WP Statistics WordPress plugin is vulnerable to SQL Injection due to insufficient escaping and parameterization of t
The WP Statistics WordPress plugin before 13.0.8 relied on using the WordPress esc_sql() function on a field not delimit
Visitor analytics data exposure in WP Statistics WordPress plugin versions before 14.16.10 allows any authenticated Word
The WP Statistics WordPress plugin before 13.2.2 does not sanitise the REQUEST_URI parameter before outputting it back i
The WP Statistics WordPress plugin is vulnerable to Cross-Site Scripting due to insufficient escaping and sanitization o
The WP Statistics WordPress plugin is vulnerable to Cross-Site Scripting due to insufficient escaping and sanitization o
The WP Statistics WordPress plugin is vulnerable to Cross-Site Scripting due to insufficient escaping and sanitization o
WordPress version 4.8 + contains a Cross Site Scripting (XSS) vulnerability in plugins.php or core wordpress on delete f
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today