CVE-2026-84774: WordPress WP Statistics plugin <= 14.16.11 - Cross Site Scripting (XSS) vulnerability
Unauthenticated Cross Site Scripting (XSS) in WP Statistics <= 14.16.11 versions.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
WordPress WP Statistics pluginto a version that resolves this vulnerability.Fixed in 14.16.12
Event History
Frequently Asked Questions
What does an attacker need to exploit this vulnerability?
The vulnerability is unauthenticated, so an attacker does not need a WordPress account or other prior privileges. Exploitation requires user interaction, as reflected by the UI:R vector.
Which installations are affected?
WP Statistics versions 14.16.11 and earlier are affected according to the provided information. The data does not state whether any particular plugin configuration is required.
What is the potential impact of successful exploitation?
Successful XSS can affect confidentiality and integrity with low impact, and its scope may extend beyond the vulnerable component. Availability impact is not indicated.