Stored Cross-Site Scripting Vulnerability in WP Statistics Plugin for WordPress

CVE-2026-5231

What is CVE-2026-5231?

The WP Statistics plugin for WordPress is susceptible to stored cross-site scripting (XSS) due to inadequate input validation and output sanitization. Specifically, the vulnerability arises from the handling of the 'utm_source' parameter. When the plugin's referral parser encounters a matching wildcard channel domain, it directly transfers the unfiltered 'utm_source' value into the 'source_name' field. Subsequently, this value is integrated into the legend markup through innerHTML without proper escaping. Consequently, this flaw allows unauthenticated attackers to inject malicious scripts that execute on the admin pages whenever an administrator accesses the Referrals Overview or Social Media analytics sections.

References