The NewStatPress plugin for WordPress is vulnerable to stored cross‑site scripting because it fails to sanitize and escape user input received via the QUERY_STRING or REQUEST_URI on all versions up to 1.4.5. When the plugin records a visitor’s URL, an unauthenticated attacker can craft a malicious URL that contains script payloads; those payloads are later stored and rendered when the corresponding page is displayed. As a result, any user who loads a page that displays the injected entry will execute the attacker’s script in their browser, potentially enabling cookie theft, session hijacking, or other client‑side attacks.

The vulnerability affects the NewStatPress plugin for WordPress, as supplied by ice00, on all versions up to and including 1.4.5. No other products or versions are listed as affected.

The CVSS score of 7.2 indicates a high severity vulnerability, but the EPSS score of less than 1% suggests that the likelihood of exploitation is low at this time. The vulnerability is not listed in CISA's KEV catalog. Exploitation requires that an administrator has placed the [NewStatPress type="Top Pages"] shortcode on a publicly viewable page and that the attacker’s crafted URL is visited frequently enough to appear in the top‑N ranking used by the plugin. Therefore the attack vector is a web request to a specially crafted URL, and the conditions for successful exploitation are relatively constrained.