NewStatPress < 1.4.5 – Unauthenticated Stored XSS via Top Post Widget | CVE 2026-14845

Description

The plugin does not sanitise and escape data derived from unauthenticated visitor requests before storing it and later outputting it in one of its widgets, which could allow unauthenticated attackers to perform Stored Cross-Site Scripting attacks against users viewing the affected widget.

Proof of Concept

Prerequisites: the NewStatPress TopPosts widget is displayed on a public page (Appearance > Widgets), with a post limit high enough for the crafted entry to appear.

1. As an unauthenticated visitor, send several page views carrying the payload in the query string so it is recorded in the stats table and ranks into TopPosts (the "p=" prefix is required to rank; use any existing published post id):

   for i in $(seq 1 10); do
     curl -s -o /dev/null "https://victim.example/?p=2'onmouseover=alert(document.domain)//"
   done

2. As a visitor, load any front-end page that displays the TopPosts widget. The widget script calls admin-ajax.php (action=newstatpress_variables&VAR=widget_topposts) and injects the response into the page via innerHTML. The stored URL is emitted unescaped, e.g.:

   <a href='?p=2\'onmouseover=alert(document.domain)//' target='_blank'>...</a>

   The single quote closes the href attribute and injects a live onmouseover handler.

3. Hover the top-post link. alert(document.domain) executes in the visitor's browser.

Note: the stored value is double-escaped (a backslash is prepended to quotes), so use a quote-free and space-free JavaScript handler as shown above; payloads using quotes (e.g. eval(atob("..."))) are broken by the backslash and do not fire.