CVE-2026-14845: NewStatPress < 1.4.5 - Unauthenticated Stored XSS via Top Post Widget
Published Jul 31, 2026
·Updated
The NewStatPress WordPress plugin before 1.4.5 does not sanitise and escape data derived from unauthenticated visitor requests before storing it and later outputting it in one of its widgets, which could allow unauthenticated attackers to perform Stored Cross-Site Scripting attacks against users viewing the affected widget.
Affected Software
1 affected component
NewStatPress NewStatPress WordPress plugin<1.4.5
Event History
Jul 31, 2026
CVE Published
via MITRE·06:00 AM
Data Sourced
via MITRE·06:00 AM
DescriptionWeakness
Data Sourced
via NVD·07:16 AM
DescriptionSeverityWeakness
Frequently Asked Questions
1
What is the severity of CVE-2026-14845?
The severity of CVE-2026-14845 is medium with a CVSS score of 6.1.
2
How do I fix CVE-2026-14845?
To fix CVE-2026-14845, update the NewStatPress WordPress plugin to version 1.4.5 or later.
3
What type of vulnerability is CVE-2026-14845?
CVE-2026-14845 is an unauthenticated stored Cross-Site Scripting (XSS) vulnerability.
4
Who is affected by CVE-2026-14845?
Users of the NewStatPress WordPress plugin prior to version 1.4.5 are affected by CVE-2026-14845.
5
Can CVE-2026-14845 be exploited without authentication?
Yes, CVE-2026-14845 can be exploited by unauthenticated attackers.