{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/products/wp-statistics-14.16.8/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":[],"_cs_cves":[{"cvss":7.2,"id":"CVE-2026-15780"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["WP Statistics (14.16.8)"],"_cs_severities":["high"],"_cs_tags":[],"_cs_type":"advisory","_cs_vendors":["WP Statistics"],"content_html":"\u003cp\u003eThe WP Statistics plugin for WordPress is vulnerable to Stored Cross-Site Scripting (XSS) in all versions up to and including 14.16.8. The vulnerability arises from improper input sanitization and output escaping of the 'utm_campaign' parameter. Attackers can exploit this by sending a crafted request to the public /wp-statistics/v2/hit REST endpoint. Because the plugin logic uses a base64-encoded 'page_uri' parameter that overrides the standard server REQUEST_URI, attackers can bypass existing sanitization mechanisms. This allows for the injection of arbitrary JavaScript which is then stored in the database. When an administrator or authenticated user views the statistics dashboard, the injected script executes within their session context, potentially leading to unauthorized actions or credential theft. This vulnerability is critical for WordPress administrators as it allows unauthenticated, remote exploitation.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation allows unauthenticated attackers to execute arbitrary JavaScript in the browser of any user who views the statistics dashboard, which typically includes site administrators. This can lead to account takeover, session hijacking, or the distribution of further malicious content to site visitors.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eImmediately update the WP Statistics plugin to version 14.16.9 or higher to patch CVE-2026-15780.\u003c/li\u003e\n\u003cli\u003eMonitor web server logs for POST requests directed to /wp-statistics/v2/hit containing suspicious payloads or high volumes of base64-encoded strings in the 'page_uri' parameter.\u003c/li\u003e\n\u003cli\u003eAudit the WP Statistics database tables for injected \u003ccode\u003e\u0026lt;script\u0026gt;\u003c/code\u003e or \u003ccode\u003eonerror\u003c/code\u003e tags within the statistics-related fields.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-08-19T08:13:34Z","date_published":"2026-08-19T08:13:34Z","id":"https://feed.craftedsignal.io/briefs/2026-08-wp-statistics-xss/","summary":"An unauthenticated stored XSS vulnerability in the WP Statistics WordPress plugin allows attackers to inject malicious scripts via the utm_campaign parameter.","title":"Stored Cross-Site Scripting in WP Statistics Plugin","url":"https://feed.craftedsignal.io/briefs/2026-08-wp-statistics-xss/"}],"language":"en","title":"CraftedSignal Threat Feed - WP Statistics (14.16.8)","version":"https://jsonfeed.org/version/1.1"}