Description

Unauthenticated Cross Site Scripting (XSS) in WP Statistics <= 14.16.13 versions.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.1",
  "pubDate": "2026-09-30T13:17:22.677Z",
  "pubdate": "2026-09-30T13:17:22.677Z",
  "executiveSummary": "The WP Statistics plugin for WordPress, in versions 14.16.13 and earlier, is susceptible to an unauthenticated Cross-Site Scripting (XSS) vulnerability. This security flaw enables remote, unauthenticated attackers to inject malicious JavaScript into web pages viewed by other users, including site administrators.\nThe vulnerability arises from improper sanitization and validation of user-supplied input before rendering it in the browser. By crafting a specific request, an attacker can execute arbitrary scripts within the security context of the victim's session.\nSuccessful exploitation poses significant risks, including the potential for session hijacking, unauthorized actions on behalf of the administrator, redirection to malicious domains, and the exfiltration of sensitive information such as CSRF tokens or user data. Given that this vulnerability requires no authentication, it is highly accessible to threat actors. Organizations utilizing affected versions of WP Statistics are advised to prioritize remediation to mitigate potential compromise of their WordPress environment.",
  "technicalDetails": "The vulnerability is identified as a Stored or Reflected Cross-Site Scripting (XSS) flaw, stemming from the insufficient sanitization of input data processed by the WP Statistics plugin. The core issue lies in the application's failure to adequately encode or validate HTTP request parameters or headers before echoing them back into the HTML document object model (DOM) of the administrative dashboard or front-end statistics display.\nIn a typical attack flow, an unauthenticated attacker identifies an input vector handled by the plugin—often related to tracking parameters or visitor metadata—that is processed by the application without rigorous filtering. The attacker constructs a malicious payload, such as '<script>alert(document.cookie)</script>', and injects it into the targeted parameter.\nWhen an unsuspecting user, particularly an administrator with higher privileges, views the statistics page or the reports generated by the plugin, the browser interprets the injected payload as executable JavaScript. This execution occurs within the victim's browser session, bypassing Same-Origin Policy (SOP) restrictions because the script is executing within the context of the vulnerable site.\nThe technical impact is extensive. Once arbitrary JavaScript execution is achieved, an attacker can manipulate the DOM to perform unauthorized administrative operations, capture session cookies, or capture keystrokes. Furthermore, if the victim is an administrator, the attacker could leverage the XSS to inject a secondary payload, such as a rogue administrator account or a malicious plugin, leading to complete site compromise (Remote Code Execution via the WordPress backend).\nThe vulnerability affects WP Statistics versions <= 14.16.13. It is exposed over the network, does not require any prior authentication or specific privileges, and is reachable by any remote user capable of interacting with the site's public or administrative interface. The flaw highlights a breakdown in the plugin's input-handling logic, specifically where user-controlled tracking data is treated as trusted content by the display components."
}