CVE-2026-97276: WordPress WP Statistics plugin <= 14.16.14 - Cross Site Scripting (XSS) vulnerability
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in VeronaLabs WP Statistics wp-statistics allows Reflected XSS.This issue affects WP Statistics: from n/a through 14.16.14.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
WordPress WP Statisticsto a version that resolves this vulnerability.Fixed in 14.16.15
Event History
Frequently Asked Questions
Which WP Statistics installations are affected?
WP Statistics versions through 14.16.14 are affected. The available information does not identify a safe fixed version.
Can this be exploited remotely without an authenticated WordPress account?
The vector is network-based and no privileges are required, but exploitation requires user interaction. The provided data does not specify the crafted request or the type of interaction required.
What is the potential impact of successful exploitation?
A successful reflected XSS attack may affect confidentiality, integrity, and availability at low impact levels. Because the scope is changed, the impact can extend beyond the vulnerable plugin's security authority.