Description

The WP Statistics – Simple, privacy-friendly Google Analytics alternative plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via REQUEST_URI Query-Parameter Key in all versions up to, and including, 14.16.14 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.1",
  "pubDate": "2026-10-02T10:17:10.163Z",
  "pubdate": "2026-10-02T10:17:10.163Z",
  "executiveSummary": "A critical security vulnerability has been identified in WP Statistics, a popular privacy-friendly Google Analytics alternative plugin for WordPress. This vulnerability, affecting all versions up to and including 14.16.14, is classified as Reflected Cross-Site Scripting (XSS). The flaw arises due to the application's failure to sufficiently sanitize and escape input supplied via the REQUEST_URI query parameter key.\nUnauthenticated attackers can leverage this vulnerability to inject arbitrary web scripts into pages served to users. Since this is a reflected vulnerability, exploitation typically requires user interaction, such as tricking a victim into clicking a specially crafted malicious link. Successful exploitation allows the execution of arbitrary JavaScript within the context of the victim's browser session, compromising session tokens, executing unauthorized actions, or facilitating phishing attacks. The impact is elevated if the targeted user possesses administrative privileges, potentially leading to complete site takeover.",
  "technicalDetails": "The root cause of this vulnerability lies in the improper processing of the REQUEST_URI server variable within the WP Statistics plugin. Specifically, when generating pages, the plugin reflects key-value pairs from the query parameter portion of the request URI directly into the HTML response without undergoing rigorous input sanitization or context-aware output escaping. Because the input validation routine fails to neutralize HTML-special characters, an attacker can craft a URI containing malicious script tags or event handlers within a query parameter key.\nIn a typical attack scenario, the threat actor constructs a malicious URL targeting the vulnerable WordPress site. This URL embeds an executable JavaScript payload within the query parameter key of the REQUEST_URI. Because the vulnerability resides in the parameter key rather than the parameter value, traditional security filters that only inspect parameter values may be bypassed. This makes standard input validation rules ineffective if they are only applied to parameter values.\nWhen an administrator or authenticated user visits this crafted URL, the WordPress application processes the request and invokes the vulnerable WP Statistics component. The component retrieves the REQUEST_URI and renders the unsanitized parameter key into the document object model (DOM) of the returned webpage. Consequently, the victim's web browser interprets the injected script as legitimate code execution from the trusted domain. This execution bypasses Same-Origin Policy (SOP) controls relative to the target application's origin.\nThe post-exploitation impact of this vulnerability is significant, particularly if the victim has administrative privileges. The executed script runs within the security context of the victim's active session. This enables the attacker to perform administrative actions, such as creating new rogue administrator accounts, modifying site configurations, or injecting persistent backdoors into the WordPress theme or database, resulting in a full compromise of the affected WordPress site. Additionally, attackers can exfiltrate sensitive session cookies if they are not configured with the HttpOnly flag."
}