Vendor
The WP-Stats plugin for WordPress is vulnerable to Stored Cross-Site Scripting (CVE-2026-19794), allowing unauthenticated attackers to inject malicious scripts into pages due to insufficient sanitization.