WordPress Plugin Vulnerabilities

WP Statistics < 14.16.15 - Reflected XSS

Description

The plugin is vulnerable to Reflected Cross-Site Scripting due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.

Affects Plugins

Plugin icon
wp-statistics
Fixed in 14.16.15

References

CVE
CVE-2026-97276
URL
https://www.wordfence.com/threat-intel/vulnerabilities/id/d7d8e8c4-f4b7-40ce-baf1-2162e7ccf05e

Classification

Type
XSS
OWASP top 10
A7: Cross-Site Scripting (XSS)
CWE
CWE-79
CVSS
6.1 (medium)

Miscellaneous

Original Researcher
b1ue0cean
Verified
No
WPVDB ID
93758f91-5f15-409e-85ec-14f73bac4dff

Timeline

Publicly Published
2026-10-02 (about 15 days ago)
Added
2026-10-09 (about 8 days ago)
Last Updated
2026-10-09 (about 8 days ago)

Other

Published
Title
Published
2023-05-25
Title
File Renaming on Upload < 2.5.2 - Admin+ Stored Cross-Site Scripting
Published
2023-04-19
Title
White Label Branding for Elementor Page Builder <= 1.0.2 - Admin+ Stored XSS
Published
2022-01-03
Title
Visual CSS Style Editor < 7.5.4 - Reflected Cross-Site Scripting
Published
2026-08-21
Title
Brave Popup Builder < 0.8.6 - Unauthenticated Reflected XSS via UTM Parameters
Published
2025-09-22
Title
WP Travel Engine < 1.4.3 - Authenticated (Contributor+) Stored Cross-Site Scripting