Description

The WP-Stats plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 2.56 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.2",
  "pubDate": "2026-08-14T08:17:38.130Z",
  "pubdate": "2026-08-14T08:17:38.130Z",
  "executiveSummary": "The WP-Stats plugin for WordPress is susceptible to a Stored Cross-Site Scripting (XSS) vulnerability across all versions up to, and including, 2.56. This security flaw stems from inadequate input sanitization and a complete lack of proper output escaping mechanisms within the application logic. The vulnerability exposes the affected WordPress installation to significant risk by allowing malicious actors to inject arbitrary web scripts or HTML payloads directly into application pages. A critical aspect of this security deficiency is that exploitation requires no prior authentication, meaning any remote attacker can interact with the vulnerable endpoint to store malicious payloads. When authenticated or unauthenticated users subsequently browse to the compromised pages, the injected scripts execute automatically within the context of the victim's browser session. This can lead to unauthorized actions performed on behalf of the user, session hijacking, credential theft, or further defacement and compromise of the web application environment. The absence of strict input validation combined with missing context-aware output encoding creates a high-risk attack surface within the plugin.",
  "technicalDetails": "The vulnerability resides in the WP-Stats plugin for WordPress, affecting all versions up to, and including, 2.56. The root cause of the flaw is insufficient input sanitization coupled with absent or improper output escaping of user-supplied data before it is rendered in the Document Object Model (DOM) of the application. Because the application accepts input without properly validating or stripping malicious characters and fails to encode data upon output, it improperly trusts data received from network requests.\nThe attack vector is network-exposed, allowing unauthenticated attackers to leverage HTTP requests to submit crafted payloads that are subsequently persisted within the database or application storage mechanism. The attacker crafts a malicious payload containing arbitrary JavaScript or HTML vectors designed to execute in the browser of anyone viewing the affected statistical pages. Since the application lacks authentication requirements for this specific injection path, zero privileges are needed to execute the initial phase of the attack.\nThe step-by-step attack flow proceeds as follows: First, the unauthenticated attacker crafts an HTTP request containing malicious script payloads targeting the vulnerable input parameters handled by the WP-Stats plugin. Second, the plugin processes the request and stores the unsanitized payload persistently within the backend database or data store without performing adequate validation or sanitization routines. Third, a victim user navigates to the specific page or component where the stored statistics and corresponding injected data are rendered. Fourth, the server outputs the unescaped payload directly into the HTTP response stream without contextual output encoding. Finally, the victim's browser parses the HTTP response, treats the malicious string as executable code rather than plain text, and executes the script within the security context of the victim's active session, granting the attacker potential access to session cookies, tokens, or localized application functionality."
}