WP-Stats - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/products/wp-stats/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioFri, 14 Aug 2026 10:07:25 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgStored Cross-Site Scripting in WP-Stats WordPress Pluginhttps://feed.craftedsignal.io/briefs/2026-08-wp-stats-xss/Fri, 14 Aug 2026 10:07:25 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-08-wp-stats-xss/The WP-Stats plugin for WordPress is vulnerable to Stored Cross-Site Scripting (CVE-2026-19794), allowing unauthenticated attackers to inject malicious scripts into pages due to insufficient sanitization.The WP-Stats plugin for WordPress is vulnerable to Stored Cross-Site Scripting (XSS) in all versions up to and including 2.56. The vulnerability arises from insufficient input sanitization and output escaping mechanisms within the plugin. This flaw permits unauthenticated attackers to inject arbitrary malicious web scripts into stored pages within the WordPress site. Once injected, these scripts execute within the context of the user's browser whenever they view the compromised page. This vulnerability poses a significant risk for session hijacking, unauthorized administrative actions, or credential theft, particularly if an administrator views the injected content.

Impact

Successful exploitation allows unauthenticated attackers to perform actions on behalf of authenticated users, potentially leading to full site compromise if an administrator interacts with the malicious payload. This vulnerability is classified as High severity with a CVSS 3.1 base score of 7.2. All WordPress environments running WP-Stats version 2.56 or lower are at risk until the plugin is updated to a patched version.

Recommendation

  • Immediately update the WP-Stats plugin to the latest version available that remediates CVE-2026-19794.
  • Implement a Content Security Policy (CSP) to restrict the execution of unauthorized scripts and mitigate the impact of stored XSS.
  • Deploy the Sigma rule provided below to monitor web server logs for suspicious payload patterns typically associated with script injection attempts.
  • Conduct a post-remediation audit of stored plugin content to identify and remove any existing malicious scripts injected during the period of vulnerability.
]]>highadvisory