Description

Unauthenticated Cross Site Scripting (XSS) in WP-Stats <= 2.56 versions.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.1",
  "pubDate": "2026-08-13T14:17:04.730Z",
  "pubdate": "2026-08-13T14:17:04.730Z",
  "executiveSummary": "An unauthenticated Cross-Site Scripting (XSS) vulnerability exists in the WP-Stats plugin for WordPress, specifically affecting versions 2.56 and prior. This security flaw allows remote, unauthenticated attackers to inject malicious client-side scripts, typically JavaScript, into vulnerable web pages rendered by the application. The primary impact of this vulnerability includes potential session hijacking, unauthorized actions performed on behalf of authenticated users, defacement of the web application, and redirection to malicious external sites. The affected systems are WordPress installations utilizing the vulnerable WP-Stats component. The risk implications are severe for web application integrity and user trust, as exploitation requires no prior authentication or specialized privileges, lowering the barrier for potential threat actors. Attackers can leverage network exposure by sending crafted HTTP requests directly to the vulnerable component without interacting with the application layer beforehand. Successful exploitation relies on the application failing to properly sanitize or encode user-supplied input before reflecting it back to the client browser, allowing the browser to execute the arbitrary script within the context of the victim's session.",
  "technicalDetails": "The vulnerability resides in the input handling and output rendering mechanisms of the WP-Stats plugin for versions <= 2.56. The root cause of the issue is inadequate input sanitization and a lack of context-aware output encoding. Specifically, the vulnerable component fails to properly filter user-supplied parameters before processing and reflecting them within the Document Object Model (DOM) of the application. Because the vulnerability is unauthenticated, an external attacker does not require any valid user account, administrative privileges, or prior interaction with the administrative interface to trigger the flaw. Network exposure is broad, as the vulnerable parameters are accessible via standard HTTP requests over the web server interface. The attack flow begins when an attacker crafts a malicious HTTP request containing an arbitrary script payload injected into vulnerable parameters handled by WP-Stats. Upon receiving the request, the vulnerable component processes the input and subsequently reflects the unsanitized payload in the HTTP response body without applying proper HTML entity encoding or other defensive sanitization techniques. When a victim's browser parses the HTTP response, it interprets the injected payload as executable script code rather than harmless text data. The payload behavior executes within the security context of the victim's browser session, granting the malicious script access to Document cookies, session tokens, and the ability to perform DOM manipulation. Post-exploitation impact varies depending on the target user; if an administrative user views the malicious payload or interacts with the compromised page, the attacker can achieve full administrative compromise of the WordPress application by dynamically creating new rogue administrator accounts or modifying core application settings. The lack of authentication requirements and direct exposure over the network vector make this vulnerability a critical vector for client-side attacks."
}