CVE-2026-93770: WordPress WP Statistics plugin <= 14.16.13 - Cross Site Scripting (XSS) vulnerability
Unauthenticated Cross Site Scripting (XSS) in WP Statistics <= 14.16.13 versions.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
WordPress WP Statistics Pluginto a version that resolves this vulnerability.Fixed in 14.16.14
Event History
Frequently Asked Questions
Who can exploit this issue?
The vulnerability is unauthenticated, so an attacker does not need a WordPress account or other prior privileges. Exploitation still requires user interaction, as indicated by the UI:R metric.
Which installations are affected?
WP Statistics versions 14.16.13 and earlier are affected according to the available data. The data does not identify any configuration prerequisite or workaround for installations that cannot be updated immediately.
What impact can successful exploitation have?
Successful XSS can affect confidentiality, integrity, and availability, each rated Low in the supplied severity vector. The scope is changed, meaning the impact may extend beyond the vulnerable component's security authority.