WP Statistics < 14.16.9 - Unauthenticated Stored XSS via 'utm_campaign' Parameter

Description

The plugin is vulnerable to Stored Cross-Site Scripting via the 'utm_campaign' parameter due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The payload can be planted without authentication via the public /wp-statistics/v2/hit REST endpoint, because the required signature is exposed on the public homepage and a base64-encoded page_uri POST parameter overrides the previously sanitized REQUEST_URI, allowing the malicious utm_campaign value to bypass sanitization and be stored in the database.