EUVD-2026-91337
GHSA-cxcf-8j7q-jhx6
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessCraft URL with XSS payload in query-param key
-
ExploitTrick logged-in user into clicking link
-
ExecutionPayload reflected via unsanitized REQUEST_URI
-
ImpactScript executes in victim's authenticated browser context
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Output encoding, context-aware escaping
MITRE ATT&CK
2 techniques across 2 tactics: Initial Access, Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires an attacker to deliver a crafted URL whose query-parameter key (reflected from REQUEST_URI) contains script, and to trick a user - in practice a logged-in administrator viewing WP Statistics admin pages such as the Referrals page (ReferralsPage.php) - into clicking it; the payload is reflected and executed because versions ≤14.16.14 insufficiently sanitize input and escape output. Limiting factors: this is reflected (non-persistent) XSS, so it requires per-victim social engineering and user interaction (UI:R) rather than passive compromise; it affects WP Statistics installations running 14.16.14 or earlier, and realistic impact depends on the victim being authenticated to wp-admin. Patched in version 14.16.15 via added HTML escaping. |
| Impact | This is a moderate-severity reflected XSS (CVSS 6.1, CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) that is network-reachable and requires no attacker privileges (PR:N), but is gated by required user interaction (UI:R) - the victim must click an attacker-crafted link. No EPSS score, CISA KEV listing, or public POC is present in the provided data, so there is no public exploit identified at time of analysis and no evidence of active exploitation. The low/moderate impact (C:L/I:L/A:N) is characteristic of reflected XSS: it does not grant direct code execution on the server and depends on social engineering for delivery, which lowers real-world exploitation probability relative to the raw CVSS network vector. The practical priority is tempered by the reflected (non-persistent) nature and the UI requirement, but the scope change (S:C) and the plugin's wide WordPress deployment keep it worth patching promptly rather than treating it as a high-urgency incident. Note: no exploitation-probability signals (EPSS/KEV/POC) were supplied, so risk is inferred from the CVSS vector and description alone - verify POC availability independently before deprioritizing. |
| Exploit ScenarioDerived | An attacker crafts a WP Statistics admin URL (e.g. targeting the Referrals page) embedding a malicious script within a query-parameter key reflected from REQUEST_URI, then lures a logged-in administrator into clicking it. When the admin opens the link, the unsanitized value is reflected into the page and the script executes in their authenticated browser session, enabling actions such as session/cookie theft or admin-context operations. No public POC is identified in the provided data. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 02, 2026
Reflected cross-site scripting in the WordPress plugin WP Statistics (VeronaLabs) affects all versions up to and including 14.16.14, allowing an unauthenticated attacker to inject arbitrary script through the query-parameter key of the request URI, which the plugin reflects into admin-side pages without adequate sanitization or output escaping. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N, 6.1) confirms no attacker privileges are needed but that exploitation is gated by user interaction - the victim, realistically a logged-in administrator viewing an affected WP Statistics admin view such as the Referrals page, must be tricked into clicking an attacker-crafted link, so impact is per-victim and social-engineering dependent rather than a passive compromise. The issue is patched in version 14.16.15; no public exploit code or confirmed active exploitation was identified at time of analysis.
RemediationAI
The primary fix is to update WP Statistics to version 14.16.15 or later; this is the vendor-released patched version, shipped as WordPress.org changeset 3722421, which adds HTML escaping in the PHP admin rendering code and wraps the affected JavaScript interpolations (baseUrl, item.url) in wps_js.escapeHtml() within assets/dev/javascript/filters/generator.js - see the upstream fix at https://github.com/wp-statistics/wp-statistics/pull/1148 and the changeset at https://plugins.trac.wordpress.org/changeset/3722421/wp-statistics/trunk/src/Service/Admin/Referrals/ReferralsPage.php. Because WP Statistics is a WordPress plugin, the patch is applied through the WordPress admin Plugins screen or WP-CLI (wp plugin update wp-statistics); sites that pin plugin versions or vendor the plugin into a deployment pipeline must update the pinned artifact manually. If immediate patching is not possible, compensating controls should target the reflected-XSS delivery path: deploy WAF or reverse-proxy rules that reject or sanitize request URIs whose query-parameter keys contain angle brackets, quotes or script fragments before they reach wp-admin (trade-off: aggressive URI filtering can cause false positives on legitimate keys containing encoded characters and must be tuned), and avoid clicking unsolicited links into wp-admin - particularly links to WP Statistics Referrals or filter views - since the attack is non-persistent and depends entirely on a crafted URL plus a click. Restricting wp-admin access by IP allowlisting or requiring re-authentication for administrative users reduces the pool of viable victims and the value of a hijacked session, at the cost of operational flexibility. Note that these controls reduce exposure but do not remove the underlying unescaped-output defect, so upgrading to 14.16.15 remains the only complete fix; no patch was identified for the plugin versions below 14.16.15 other than the 14.16.15 release itself.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The flaw is a classic CWE-79 (Improper Neutralization of Input During Web Page Generation) reflected XSS rooted in how the WP Statistics admin UI builds HTML from server-supplied values. Per the referenced source, the plugin's admin rendering path in src/Abstracts/MultiViewPage.php (around line 82) and src/Service/Admin/Referrals/ReferralsPage.php (around lines 258, 283 and 310) passes the raw request URI/query-parameter key into markup, while the client-side filter generator in assets/dev/javascript/filters/generator.js (around lines 383 and 392) interpolates values such as baseUrl and item.url directly into anchor href attributes inside template strings. Because the parameter key portion of REQUEST_URI is not sanitized on input and not escaped on output, an attacker-controlled key containing markup-breaking characters is reflected into the rendered admin page and executes in the context of the victim's session. The upstream fix, visible in GitHub pull request wp-statistics/wp-statistics#1148 and WordPress.org changeset 3722421 (tag 14.16.15), wraps those interpolations with wps_js.escapeHtml() in generator.js and adds corresponding escaping in the PHP rendering code, converting the unescaped sinks into safely encoded output. The CPE entry (cpe:2.3:a:veronalabs:wp_statistics_-_simple,_privacy-friendly_google_analytics_alternative) uses a wildcard version, so the authoritative version boundary comes from the advisory and EUVD data: everything at or below 14.16.14 is affected.
Know when Wp Statistics Simple Privacy Friendly Google Analytics Alternative gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Reflected XSS is network-exploitable with no privileges (PR:N) but needs the victim to click (UI:R); script runs across security boundaries in the browser (S:C) with limited C/I impact and no availability effect.
Primary rating from Vendor (Wordfence).
CVSS VectorVendor: Wordfence
DescriptionCVE.org
The WP Statistics - Simple, privacy-friendly Google Analytics alternative plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via REQUEST_URI Query-Parameter Key in all versions up to, and including, 14.16.14 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Cross-Site Scripting occurs when an application accepts untrusted data and sends it to a web browser without proper validation or encoding.
Stored cross-site scripting in WP Statistics (all versions through 14.16.8) allows unauthenticated remote attackers to p
Stored Cross-Site Scripting in WP Statistics plugin (≤14.16.4) allows unauthenticated attackers to inject malicious Java
WP Statistics plugin for WordPress versions up to 14.16.4 fail to enforce capability checks on multiple AJAX endpoints,
Exploit-DB