rootpwn

high · CVSS v3 7.1 · EPSS 0.00146

CVE-2026-97276

WP Statistics plugin for WordPress contains a reflected XSS flaw that can be triggered via crafted URLs, allowing attackers to inject malici

Overview

WP Statistics plugin for WordPress contains a reflected XSS flaw that can be triggered via crafted URLs, allowing attackers to inject malicious scripts into pages viewed by site visitors. The vulnerability exists in all releases up to 14.16.14 and can lead to data theft or defacement.

Description

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in VeronaLabs WP Statistics wp-statistics allows Reflected XSS.This issue affects WP Statistics: from n/a through 14.16.14.

Impact

The flaw can compromise confidentiality by enabling attackers to steal session cookies or other sensitive data, and can undermine integrity by allowing unauthorized content injection. Site administrators and visitors are directly impacted, as any user who loads a crafted page can be affected.

Remediation

Update WP Statistics to version 14.16.15 or later. If an update is not immediately possible, disable the plugin or restrict its usage to trusted users. Implement a Content Security Policy that blocks inline scripts and disallows execution of untrusted code. Monitor logs for suspicious URL patterns and apply input sanitization on any custom query parameters.

Risk context

The vulnerability is rated high severity (CVSS 7.1) but has a low EPSS score of 0.00146, indicating a low likelihood of exploitation yet still requiring timely mitigation.

Affected products

  • VeronaLabs WP Statistics
  • WordPress WP Statistics plugin

Scores

Severity
high
CVSS v2
7.5
CVSS v3
7.1
CVSS v4
—
EPSS
0.00146

XSS WP Statistics WordPress Reflected XSS High Severity Input Validation Web Vulnerability

← All CVEs

Related CVEs

high

CVE-2026-88782

The Kubio AI Page Builder WordPress plugin (v<2.9.3) fails to validate URI schemes in user-supplied link targets, enabling stored XSS. Contributors and higher can inject malicious payloads that execute in the browsers of anyone who clicks the link, including administrators previewing drafts. This flaw can lead to session hijacking or defacement.

View analysis

high

CVE-2026-97935

A use‑after‑free bug in the Linux kernel tracing subsystem allows a malformed histogram trigger to corrupt the named_triggers list. The flaw occurs when an invalid clock string is supplied, causing the trigger to be registered before the clock is validated. This can lead to kernel memory corruption and potential privilege escalation.

View analysis

high

CVE-2026-105126

LaraDashboard versions before 1.4.8 have a privilege escalation flaw that lets authenticated Admin users gain Superadmin rights by editing or renaming roles. This allows attackers to access core upgrade and module installation functions, potentially leading to code execution. The vulnerability is exploitable by users with role.edit permissions.

View analysis

high

CVE-2026-105129

LaraDashboard before 1.4.8 contains an authorization flaw that allows users with only settings.view permission to read sensitive secrets via the settings API. This exposes AI provider keys, mail credentials, passwords, and tokens to any authenticated user. The vulnerability can be exploited by any user who has logged in.

View analysis