CVE-2026-15780: WP Statistics <= 14.16.8 - Unauthenticated Stored Cross-Site Scripting via 'utm_campaign' Parameter
The WP Statistics – Simple, privacy-friendly Google Analytics alternative plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'utmcampaign' parameter in all versions up to, and including, 14.16.8 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The payload can be planted without authentication via the public /wp-statistics/v2/hit REST endpoint, because the required signature is exposed on the public homepage and a base64-encoded pageuri POST parameter overrides the previously sanitized REQUESTURI, allowing the malicious utmcampaign value to bypass sanitization and be stored in the database.
Affected Software
Event History
Frequently Asked Questions
Which installations are exposed?
Installations using WP Statistics versions up to and including 14.16.8 are affected. Exploitation targets the plugin's publicly reachable /wp-statistics/v2/hit REST endpoint.
Does an attacker need an account or interaction from a privileged user to plant the payload?
No. An unauthenticated attacker can submit the payload because the endpoint signature is exposed on the public homepage. The script executes later when a user accesses a page containing the injected content.
What conditions make exploitation possible?
The attacker uses a base64-encoded page_uri POST parameter to override the previously sanitized REQUEST_URI and supply a malicious utm_campaign value. The vulnerable plugin then stores that value in its database without sufficient sanitization or output escaping.