The plugin stores arbitrary scripts in its database that are later displayed on pages. An attacker can inject malicious code via an unsanitized User‑Agent header and, because the flaw is stored, the code persists for anyone who views a page. The primary impact is client‑side code execution, which can lead to session hijacking, cookie theft, or defacement.

WP Statistics – Simple, privacy-friendly Google Analytics alternative for WordPress. Versions up to and including 14.5.4 are vulnerable.

The CVSS score of 7.2 classifies this as a high‑severity issue. The EPSS score of less than 1% indicates that real‑world exploitation is currently unlikely, and it is not listed in CISA’s KEV catalog. The flaw can be exploited by any unauthenticated user simply by crafting an HTTP request with a malicious User‑Agent header; no additional prerequisites are required. Attackers could therefore inject scripts that execute whenever any site visitor loads a page that retrieves the stored data, leading to widespread client‑side compromise.