Stored Cross-Site Scripting Vulnerability in NewStatPress Plugin by WordPress
CVE-2026-14845
Currently unrated
Key Information:
- Vendor
WordPress
- Status
- Vendor
- CVE Published:
- 31 July 2026
Badges
👾 Exploit Exists🟡 Public PoC
What is CVE-2026-14845?
The NewStatPress plugin for WordPress, prior to version 1.4.5, fails to properly sanitize and escape user data obtained from unauthenticated visitor inputs. This oversight allows attackers to exploit the plugin by injecting malicious scripts into stored data. When users view the affected widget, these scripts are executed in their browsers, potentially compromising user data and site integrity.
Affected Version(s)
NewStatPress 0 < 1.4.5
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.