Stored Cross-Site Scripting in NewStatPress Plugin for WordPress

CVE-2025-13747

What is CVE-2025-13747?

The NewStatPress plugin for WordPress suffers from a Stored Cross-Site Scripting vulnerability due to a regex bypass in the nsp_shortcode function. This weakness arises from inadequate input sanitization and output escaping of user-supplied attributes, affecting all versions up to and including 1.4.3. Authenticated attackers with contributor-level access or higher can exploit this vulnerability to inject arbitrary web scripts, which will execute whenever users access the compromised pages, posing significant risks to site integrity and user safety.

References