CVE-2026-19794: WP-Stats <= 2.56 - Unauthenticated Stored Cross-Site Scripting
The WP-Stats plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 2.56 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
WordPress plugin: WP-Statsto a version that resolves this vulnerability.Fixed in 2.56 - Compensating control
Mitigate by restricting unauthenticated access to WordPress pages where the WP-Stats output may be rendered (e.g., via web server/ACL or access control) until WP-Stats is updated.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-19794?
The severity of CVE-2026-19794 is high, with a score of 7.2.
How do I fix CVE-2026-19794?
To fix CVE-2026-19794, update the WP-Stats plugin to the latest version that addresses this vulnerability.
What type of vulnerability is CVE-2026-19794?
CVE-2026-19794 is classified as an Unauthenticated Stored Cross-Site Scripting (XSS) vulnerability.
Who is affected by CVE-2026-19794?
All users of the WP-Stats plugin for WordPress versions up to and including 2.56 are affected by CVE-2026-19794.
What can attackers do with CVE-2026-19794?
Attackers can inject arbitrary web scripts into pages, which will execute when users visit those pages, potentially leading to data theft or site compromise.