Stored Cross-Site Scripting in NewStatPress for WordPress

CVE-2026-101924

What is CVE-2026-101924?

The NewStatPress plugin for WordPress suffers from a Stored Cross-Site Scripting (XSS) vulnerability affecting versions up to 1.4.5. This security issue arises from inadequate output escaping of user-supplied data within the 'Last referrers' meta box on the plugin's Overview admin page. Specifically, the function responsible for displaying this data, newstatpress_generate_overview_lastreferrers(), lacks proper handling, only applying FILTER_SANITIZE_URL to the stored URL. This insufficient sanitization allows unauthenticated attackers to successfully inject malicious web scripts. Such scripts can execute when high-privileged users, like administrators, access the Overview page and hover over the crafted links, potentially leading to unauthorized actions within the site.

References