Stored Cross-Site Scripting in WP Statistics Plugin

The WP Statistics plugin for WordPress is vulnerable to Stored Cross-Site Scripting (XSS) in all versions up to and including 14.16.8. The vulnerability arises from improper input sanitization and output escaping of the 'utm_campaign' parameter. Attackers can exploit this by sending a crafted request to the public /wp-statistics/v2/hit REST endpoint. Because the plugin logic uses a base64-encoded 'page_uri' parameter that overrides the standard server REQUEST_URI, attackers can bypass existing sanitization mechanisms. This allows for the injection of arbitrary JavaScript which is then stored in the database. When an administrator or authenticated user views the statistics dashboard, the injected script executes within their session context, potentially leading to unauthorized actions or credential theft. This vulnerability is critical for WordPress administrators as it allows unauthenticated, remote exploitation.

Impact

Successful exploitation allows unauthenticated attackers to execute arbitrary JavaScript in the browser of any user who views the statistics dashboard, which typically includes site administrators. This can lead to account takeover, session hijacking, or the distribution of further malicious content to site visitors.

Recommendation

• Immediately update the WP Statistics plugin to version 14.16.9 or higher to patch CVE-2026-15780.
• Monitor web server logs for POST requests directed to /wp-statistics/v2/hit containing suspicious payloads or high volumes of base64-encoded strings in the 'page_uri' parameter.
• Audit the WP Statistics database tables for injected <script> or onerror tags within the statistics-related fields.