Description

The WP Statistics – Simple, privacy-friendly Google Analytics alternative plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'utm_campaign' parameter in all versions up to, and including, 14.16.8 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The payload can be planted without authentication via the public /wp-statistics/v2/hit REST endpoint, because the required signature is exposed on the public homepage and a base64-encoded page_uri POST parameter overrides the previously sanitized REQUEST_URI, allowing the malicious utm_campaign value to bypass sanitization and be stored in the database.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.2",
  "pubDate": "2026-08-19T07:16:27.773Z",
  "pubdate": "2026-08-19T07:16:27.773Z",
  "executiveSummary": "The WP Statistics plugin for WordPress is susceptible to a Stored Cross-Site Scripting (XSS) vulnerability affecting all versions up to and including 14.16.8. The flaw stems from insufficient input sanitization and inadequate output escaping applied to the 'utm_campaign' parameter. This security defect enables unauthenticated malicious actors to inject arbitrary web scripts into application pages, which execute within the context of a victim user's browser session whenever the injected page is accessed.\nThe attack vector is exposed publicly via the /wp-statistics/v2/hit REST API endpoint. Because the cryptographic signature required for the request is publicly obtainable on the homepage, and a base64-encoded 'page_uri' POST parameter allows circumvention of the standard REQUEST_URI sanitization pipeline, an attacker can successfully store malicious payloads inside the database without prior authentication or elevated privileges.\nThe risk implications are severe, as successful exploitation permits arbitrary script execution against any user visiting the affected statistics pages. This could lead to administrative session hijacking, credential theft, or unauthorized modification of site content depending on the privileges of the user viewing the compromised pages.",
  "technicalDetails": "The vulnerability resides in the request handling logic of the WP Statistics plugin, specifically within the processing of incoming hit tracking data submitted to the public REST API endpoint located at /wp-statistics/v2/hit. The root cause involves inadequate input sanitization and a lack of proper output escaping mechanisms for the 'utm_campaign' parameter before database persistence.\nExploitation is facilitated by architectural weaknesses in how tracking parameters are validated and processed. The endpoint relies on a signature parameter for validation; however, this required signature is publicly exposed and obtainable directly from the site's homepage, nullifying its intended security boundary. Furthermore, the handling of the 'page_uri' parameter introduces a critical validation bypass. When a base64-encoded 'page_uri' POST parameter is supplied in the request, it overrides the previously sanitized REQUEST_URI value. This bypass mechanism prevents the normal sanitization routines from inspecting the payload context properly.\nThe step-by-step attack flow proceeds as follows: First, an unauthenticated attacker retrieves the necessary request signature from the public homepage. Second, the attacker constructs a malicious HTTP POST request targeted at the /wp-statistics/v2/hit REST endpoint. This request includes a base64-encoded 'page_uri' parameter to trigger the URI override condition alongside a crafted 'utm_campaign' parameter containing malicious JavaScript payloads. Third, the plugin processes the request, bypasses the standard input filters due to the URI override, and directly commits the unsanitized 'utm_campaign' value into the underlying database as part of the statistics records.\nSubsequent attack behavior occurs when an administrator or any other user accesses the statistics dashboard or pages where the stored metric data is rendered without proper output escaping. The malicious script is retrieved from the database and reflected directly into the Document Object Model (DOM), executing arbitrary JavaScript in the victim's browser session. The affected component is the tracking and statistics recording subsystem across all versions up to and including 14.16.8, requiring zero authentication or privileges to initiate the payload storage phase over the network."
}