Stored Cross-Site Scripting in NewStatPress Plugin for WordPress

CVE-2025-13747

What is CVE-2025-13747?

The NewStatPress plugin for WordPress suffers from a Stored Cross-Site Scripting vulnerability due to a regex bypass in the nsp_shortcode function. This weakness arises from inadequate input sanitization and output escaping of user-supplied attributes, affecting all versions up to and including 1.4.3. Authenticated attackers with contributor-level access or higher can exploit this vulnerability to inject arbitrary web scripts, which will execute whenever users access the compromised pages, posing significant risks to site integrity and user safety.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References