WP Statistics < 14.16.15 - Reflected XSS via REQUEST_URI Query-Parameter Key

Description

The plugin is vulnerable to Reflected Cross-Site Scripting via the REQUEST_URI query-parameter key due to insufficient input sanitization and output escaping, allowing unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking a link.