Description
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in PluginsPoint Kento WordPress Stats kento-wp-stats allows Stored XSS.This issue affects Kento WordPress Stats: from n/a through <= 1.1.
Published: 2025-04-01
Score: 7.1 High
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

The Kento WordPress Stats plugin contains an input handling flaw that does not properly neutralize content before rendering it in web pages. This flaw allows an attacker to store malicious scripts that are executed when a page containing the stored content is loaded by a visitor. The vulnerability is a stored cross‑site scripting issue and is indexed as CWE‑79.

Affected Systems

The affected product is the PluginsPoint Kento WordPress Stats plugin, with all releases from n/a through version ≤ 1.1 vulnerable. No specific release is exempt.

Risk and Exploitability

The CVSS score of 7.1 indicates a high severity level. The EPSS score of less than 1% shows that the likelihood of exploitation at present is very low, and the vulnerability is not listed in CISA’s KEV catalog. Likely attack vectors include a user with permission to submit or edit content within WordPress or to configure the plugin, thereby storing a malicious payload that is later rendered for all site visitors.

Generated by OpenCVE AI on May 2, 2026 at 02:50 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade Kento WordPress Stats to a version that contains the fix or that removes the vulnerable code.
  • If no update is available, disable or uninstall the plugin to eliminate the attack surface.
  • Implement site‑wide input sanitization or a strong Content Security Policy that blocks inline scripts as a temporary mitigating measure.

Generated by OpenCVE AI on May 2, 2026 at 02:50 UTC.

Tracking

Sign in to view the affected projects.

Advisories
Source ID Title
EUVD EUVD EUVD-2025-9109 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in NotFound Kento WordPress Stats allows Stored XSS. This issue affects Kento WordPress Stats: from n/a through 1.1.
History

Thu, 23 Apr 2026 15:00:00 +0000

Type Values Removed Values Added
Metrics cvssV3_1

{'score': 7.1, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L'}

Wed, 01 Apr 2026 23:45:00 +0000

Type Values Removed Values Added
Description Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in NotFound Kento WordPress Stats allows Stored XSS. This issue affects Kento WordPress Stats: from n/a through 1.1. Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in PluginsPoint Kento WordPress Stats kento-wp-stats allows Stored XSS.This issue affects Kento WordPress Stats: from n/a through <= 1.1.
References
Metrics cvssV3_1

{'score': 7.1, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L'}

Tue, 01 Apr 2025 14:15:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Tue, 01 Apr 2025 05:45:00 +0000

Type Values Removed Values Added
Description Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in NotFound Kento WordPress Stats allows Stored XSS. This issue affects Kento WordPress Stats: from n/a through 1.1.
Title WordPress Kento WordPress Stats plugin <= 1.1 - Cross Site Scripting (XSS) vulnerability
Weaknesses CWE-79
References
Metrics cvssV3_1

{'score': 7.1, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L'}

Subscriptions

No data.

cve-icon MITRE

Status: PUBLISHED

Assigner: Patchstack

Published:

Updated: 2026-04-28T16:11:54.083Z

Reserved: 2025-03-24T12:59:58.193Z

Link: CVE-2025-30559

cve-icon Vulnrichment

Updated: 2025-04-01T13:25:45.498Z

cve-icon NVD

Status : Deferred

Published: 2025-04-01T06:15:49.110

Modified: 2026-04-23T15:26:51.990

Link: CVE-2025-30559

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-05-02T03:00:13Z

Weaknesses