Wp Statistics Simple Privacy Friendly Google Analytics Alternative
EUVD-2026-23342
|
CVE-2026-5231
HIGH
Severity by source
AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
Lifecycle Timeline
6DescriptionCVE.org
The WP Statistics plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'utm_source' parameter in all versions up to, and including, 14.16.4. This is due to insufficient input sanitization and output escaping. The plugin's referral parser copies the raw utm_source value into the source_name field when a wildcard channel domain matches, and the chart renderer later inserts this value into legend markup via innerHTML without escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in admin pages that will execute whenever an administrator accesses the Referrals Overview or Social Media analytics pages.
AnalysisAI
Stored Cross-Site Scripting in WP Statistics plugin (≤14.16.4) allows unauthenticated attackers to inject malicious JavaScript into admin dashboard analytics pages. The vulnerability stems from unsafe handling of utm_source URL parameters that persist into database-backed charts, executing when administrators view Referrals Overview or Social Media pages. With CVSS 7.2 and network vector requiring no authentication, this represents elevated risk for WordPress sites using this analytics plugin, though no active exploitation confirmed at time of analysis.
Technical ContextAI
WP Statistics is a WordPress analytics plugin (cpe:2.3:a:veronalabs:wp_statistics) that tracks visitor referrals and UTM campaign parameters. The vulnerability (CWE-79: Improper Neutralization of Input During Web Page Generation) exists in the referral parsing pipeline. When processing incoming traffic with utm_source parameters, the ReferralsParser.php (line 62) copies raw utm_source values directly into the source_name database field when wildcard channel domain patterns match. Later, chart.js (line 498) renders this stored data into chart legends using innerHTML without HTML escaping. This creates a classic stored XSS where attacker-controlled URL parameters become persistent database content that executes JavaScript in administrative contexts. The attack surface is the public-facing WordPress site (any page accepting UTM parameters), but the impact zone is admin dashboard pages where charts render.
RemediationAI
Upgrade WP Statistics plugin to version 14.16.5 or later, which addresses the XSS vulnerability per the Trac changeset at https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3503795%40wp-statistics%2Ftrunk&old=3483860%40wp-statistics%2Ftrunk. The patch implements proper output escaping in chart.js rendering and input sanitization in ReferralsParser.php. If immediate patching is not feasible, disable the Referrals Overview and Social Media analytics features in WP Statistics settings to prevent payload execution (this removes vulnerable chart rendering but eliminates referral tracking functionality). Alternatively, restrict WordPress admin dashboard access to trusted networks via .htaccess IP whitelisting or firewall rules, reducing exposure to payload execution (does not prevent injection, only limits who can trigger execution). Review existing analytics data for anomalous utm_source entries containing HTML/JavaScript syntax and purge suspicious records from the database statistics tables. No workaround fully mitigates the vulnerability without applying the vendor patch.
Stored cross-site scripting in WP Statistics (all versions through 14.16.8) allows unauthenticated remote attackers to p
WP Statistics plugin for WordPress versions up to 14.16.4 fail to enforce capability checks on multiple AJAX endpoints,
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today