WordPress Plugin Vulnerabilities

WP Statistics < 14.16.12 - Unauthenticated Stored XSS

Description

The plugin is vulnerable to Stored Cross-Site Scripting due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

Affects Plugins

Plugin icon
wp-statistics
Fixed in 14.16.12

References

CVE
CVE-2026-84774
URL
https://www.wordfence.com/threat-intel/vulnerabilities/id/46ee11ee-79ef-4a64-8e04-43915fb4774e

Classification

Type
XSS
OWASP top 10
A7: Cross-Site Scripting (XSS)
CWE
CWE-79
CVSS
7.2 (high)

Miscellaneous

Original Researcher
TwinSecKR
Verified
No
WPVDB ID
f0df7525-afab-4976-96ef-b0e06e7cbcc6

Timeline

Publicly Published
2026-09-02 (about 1 month ago)
Added
2026-09-09 (about 1 month ago)
Last Updated
2026-10-16 (about 8 hours ago)

Other

Published
Title
Published
2024-04-05
Title
Gradient Text Widget for Elementor <= 1.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
Published
2025-08-20
Title
SlingBlocks – Gutenberg Blocks by FunnelKit (Formerly WooFunnels) < 1.7.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
Published
2025-07-04
Title
My Reservation System <= 2.3 - Reflected XSS
Published
2026-10-02
Title
Ultimate Member < 2.14.0 - Unauthenticated Stored XSS via 'form_id' Parameter
Published
2026-08-07
Title
Visitor Traffic Real Time Statistics pro < 11.11 - Unauthenticated Stored Cross-Site Scripting