EUVD-2026-62341
GHSA-3hm7-m5p9-2h77
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessRetrieve API signature from public homepage HTML
-
DeliveryPOST crafted request to /wp-statistics/v2/hit with base64-encoded page_uri
-
ExploitDecoded page_uri overrides sanitized REQUEST_URI
-
ExecutionMalicious utm_campaign value written to visitor database
-
PersistAdmin navigates to WP Statistics visitor or referral report
-
ImpactStored XSS payload executes in admin browser session
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Output encoding, context-aware escaping
MITRE ATT&CK
2 techniques across 2 tactics: Initial Access, Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | The WP Statistics plugin must be installed and active, and the /wp-statistics/v2/hit REST API endpoint must be reachable over the network - this is the default state for any public-facing WordPress site running the plugin. The required API request signature must be obtainable from the public homepage HTML, a condition inherent to the plugin's design in all affected versions and requiring no special knowledge or tooling. No WordPress account, authentication token, or elevated network position is required to plant the payload. Exploitation impact is bounded by the requirement that a privileged user (an administrator or any WordPress user with access to the WP Statistics dashboard) must subsequently view the affected visitor or referral report pages for the stored XSS to fire; the payload does not execute for front-end visitors browsing the public site. No non-default plugin configuration is needed to be vulnerable. |
| Impact | The CVSS 7.2 score is primarily driven by AV:N/AC:L/PR:N and a scope change (S:C), which accurately reflect that no credentials are required and the public signature exposure keeps exploitation complexity low. The C:L/I:L impact ratings are conservative but appropriate for a stored XSS that enables admin session hijacking rather than direct data exfiltration. One notable discrepancy: the provided vector carries UI:N, which is atypical for stored XSS - the payload only fires when a privileged user views the statistics dashboard, which standard CVSS 3.1 practice typically encodes as UI:R; security teams should verify with the vendor whether the UI:N rating reflects an unusual delivery mechanism or is a scoring error. No EPSS probability score was included in the available data, and the vulnerability is absent from the CISA KEV catalog, so active widespread exploitation is not confirmed. No public proof-of-concept code was identified. Despite these softer risk signals, the combination of zero authentication requirement, trivially obtainable bypass, and a large WordPress plugin install base means that even a mid-sized municipal IT team in gliwice managing a portfolio of WordPress properties should treat this as an urgent patch cycle item rather than a deferred maintenance task. |
| Exploit ScenarioDerived | An unauthenticated attacker loads the target WordPress site's homepage, extracts the required API signature from the rendered HTML, and sends a crafted POST request to /wp-statistics/v2/hit with a base64-encoded page_uri parameter embedding a utm_campaign value containing a JavaScript payload such as a session-cookie harvester. The plugin decodes the parameter without sanitization, stores the malicious value in the visitor database, and the payload silently waits. When a site administrator next opens the WP Statistics visitor or referral report in the WordPress dashboard, the unsanitized utm_campaign value is rendered into the page and the attacker's script executes in the admin's authenticated browser context. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Aug 19, 2026
Stored cross-site scripting in WP Statistics (all versions through 14.16.8) allows unauthenticated remote attackers to permanently inject arbitrary JavaScript into a WordPress site's database and have it execute in any privileged user's browser session when viewing the plugin's statistics dashboards. The vulnerability chain is precise: the REST API signature required to submit a hit request is exposed on the public homepage, and a base64-encoded page_uri POST parameter to the /wp-statistics/v2/hit endpoint overrides the previously sanitized REQUEST_URI, smuggling an unsanitized utm_campaign value into the database. No public exploit code or CISA KEV listing has been identified at time of analysis, though the low exploitation complexity and large WordPress install base elevate practical urgency significantly.
RemediationAI
Administrators should update WP Statistics to a release incorporating the upstream fix from commit 6ab74427778b89c9e88471e9dd7407d9055a9b34 (https://github.com/wp-statistics/wp-statistics/commit/6ab74427778b89c9e88471e9dd7407d9055a9b34), which applies sanitize_url() around base64_decode() calls in class-wp-statistics-helper.php and class-wp-statistics-hits.php, and adds sanitize_text_field() to utm_campaign retrieval in all affected view templates. A specific patched release version number was not explicitly stated in the available data; administrators should consult the plugin changelog or the Wordfence advisory to confirm the first version shipping this commit. As a compensating control where immediate upgrade is not possible, blocking unauthenticated POST requests to the /wp-statistics/v2/hit REST API endpoint via a WAF rule or WordPress REST API namespace restriction will prevent new payloads from being planted, with the trade-off that hit-tracking functionality will be disabled for the duration. Additionally, auditing the wp_statistics database tables for utm_campaign values containing script tags or JavaScript URIs can identify whether payloads have already been stored prior to patching.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
WP Statistics (CPE: cpe:2.3:a:veronalabs:wp_statistics_-_simple,_privacy-friendly_google_analytics_alternative:*:*:*:*:*:*:*:*) is a PHP-based WordPress analytics plugin that tracks visitor data via a REST API v2 endpoint. The root cause is CWE-79 (Improper Neutralization of Input During Web Page Generation) manifesting across two distinct code paths: in class-wp-statistics-helper.php (line 1462) and class-wp-statistics-hits.php (line 102), the page_uri parameter is base64-decoded without subsequent URL sanitization, allowing a crafted value carrying a malicious utm_campaign query string component to reach database write operations uncleaned. That stored utm_campaign value is later retrieved and rendered without HTML escaping in at least five view templates - visitors.php, referred-visitors.php, top-visitors.php, most-active-visitors.php, and latest-referrals.php - satisfying the classic stored XSS source-to-sink pattern. A compounding design flaw is that the API signature required to authenticate the hit request is derivable from the public homepage HTML, effectively eliminating the authentication barrier the signature was intended to provide.
Know when Wp Statistics Simple Privacy Friendly Google Analytics Alternative gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N
UI:R assigned because stored XSS payload only fires when an administrator views a statistics report; all other metrics align with the provided vector.
Primary rating from Vendor (Wordfence).
CVSS VectorVendor: Wordfence
DescriptionCVE.org
The WP Statistics - Simple, privacy-friendly Google Analytics alternative plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'utm_campaign' parameter in all versions up to, and including, 14.16.8 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The payload can be planted without authentication via the public /wp-statistics/v2/hit REST endpoint, because the required signature is exposed on the public homepage and a base64-encoded page_uri POST parameter overrides the previously sanitized REQUEST_URI, allowing the malicious utm_campaign value to bypass sanitization and be stored in the database.
Executive ViewAI
WP Statistics WordPress plugin (all versions through 14.16.8) contains a stored cross-site scripting vulnerability allowing unauthenticated attackers to permanently inject malicious JavaScript into affected sites. When administrators access the plugin's dashboards, injected code executes with administrative privileges, enabling attackers to steal credentials, compromise accounts, and access sensitive data. With no currently available vendor patch and straightforward exploitation methods, this vulnerability requires immediate assessment and remediation for any WordPress installation using the plugin.
No vendor-released patch identified at time of analysis. Interim mitigations include: (1) immediately disable and remove the WP Statistics plugin if operationally feasible; (2) restrict REST API access to authenticated users only via .htaccess, nginx, or WAF rules; (3) implement logging and alerting for POST requests to /wp-statistics/v2/hit containing base64-encoded or suspicious utm_campaign parameter values; (4) monitor administrative user sessions and browser activity for signs of compromise; (5) consider Web Application Firewall (WAF) rules to detect and block XSS payloads in request parameters.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Cross-Site Scripting occurs when an application accepts untrusted data and sends it to a web browser without proper validation or encoding.
Stored Cross-Site Scripting in WP Statistics plugin (≤14.16.4) allows unauthenticated attackers to inject malicious Java
WP Statistics plugin for WordPress versions up to 14.16.4 fail to enforce capability checks on multiple AJAX endpoints,
Reflected cross-site scripting in the WordPress plugin WP Statistics (VeronaLabs) affects all versions up to and includi
Exploit-DB