WP Statistics – Simple, privacy-friendly Google Analytics alternative <= 14.16.14 - Reflected Cross-Site Scripting via Report Filter Dropdown URLs
- ID
- WPSEC-2026-0018
- Plugin
- WP Statistics – Simple, privacy-friendly Google Analytics alternative (wp-statistics)
- Affected
- from 14.13 before 14.16.15
- Remediation
- Update to 14.16.15 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
- Weakness
- CWE-79
- Usage
- Plugin High · Affected versions High among sites WPSec scans, 2026-10-22
- Attack surface
- WP Statistics – Simple, privacy-friendly Google Analytics alternative on WPSec AttackSurface
- Fix released
- Published
Also published later by Wordfence as CVE-2026-97652, on 2026-10-01.
Description
The WP Statistics plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the filter dropdown URLs of admin reports such as Referrals and Author Analytics in versions 14.13 through 14.16.14. This is due to insufficient escaping of URLs built from the current request URI, which the admin JavaScript then inserts into the dropdown HTML without escaping. Some filter URLs were passed through esc_url() and then htmlspecialchars_decode(), which reverses the escaping. Others were built with add_query_arg() from the raw request URI with no escaping at all. This makes it possible for unauthenticated attackers to inject arbitrary web scripts into report pages. The scripts execute if the attacker tricks a logged-in user with access to the reports, such as an administrator, into clicking a crafted link.
References
- https://wpsec.com/vuln/WPSEC-2026-0018/
- https://plugins.svn.wordpress.org/wp-statistics/tags/14.16.15/
- https://wordpress.org/plugins/wp-statistics/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS