Stored Cross-Site Scripting in WP Statistics Plugin for WordPress
CVE-2026-15780

7.2HIGH

Key Information:

Vendor

WordPress
Status
WP Statistics – Simple, Privacy-friendly Google Analytics Alternative
Vendor
CVE Published:
19 August 2026

What is CVE-2026-15780?

The WP Statistics plugin for WordPress is susceptible to Stored Cross-Site Scripting (XSS) through the 'utm_campaign' parameter. This vulnerability arises from inadequate input sanitization and output escaping across all versions up to 14.16.8. Unauthenticated attackers can exploit this flaw by injecting malicious web scripts through the public /wp-statistics/v2/hit REST endpoint, as required signatures are exposed on the public homepage. The base64-encoded page_uri POST parameter can overwrite prior sanitization, enabling harmful values to be stored in the database, leading to potential execution of scripts whenever users access compromised pages.

Affected Version(s)

WP Statistics – Simple, privacy-friendly Google Analytics alternative 0 <= 14.16.8

References

https://www.wordfence.com/threat-intel/vulnerabilities/id...
https://plugins.trac.wordpress.org/browser/wp-statistics/...
https://plugins.trac.wordpress.org/browser/wp-statistics/...

CVSS V3.1

Score:
7.2
Severity:
HIGH
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

tipsen
.