CVE-2026-97652: WP Statistics <= 14.16.14 - Reflected Cross-Site Scripting via REQUEST_URI Query-Parameter Key
The WP Statistics – Simple, privacy-friendly Google Analytics alternative plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via REQUESTURI Query-Parameter Key in all versions up to, and including, 14.16.14 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
Affected Software
Event History
Frequently Asked Questions
Who is exposed to this issue?
WordPress sites running VeronaLabs WP Statistics version 14.16.14 or earlier are affected. Exploitation targets a user who can be persuaded to visit a crafted link.
Does an attacker need an account or prior access to exploit it?
No. The issue can be exploited by an unauthenticated attacker, but it requires user interaction such as clicking a malicious link.
What is the potential impact if exploitation succeeds?
An attacker can cause arbitrary script to execute in the affected page's context. The listed impacts include limited confidentiality and integrity impact, with no availability impact.