The NewStatPress plugin for WordPress up to version 1.4.5 stores visitor URLs without proper escaping, concatenating them into an href attribute after only URL sanitization. This leads to a stored cross‑site scripting flaw that can inject any JavaScript. An attacker can trigger the injection by sending a crafted URL to the website, and when an administrator opens the Overview page the malicious script runs in that privileged session. The weakness is a classic input‑output validation error, CWE‑79.

Affected systems include installations of the NewStatPress plugin version 1.4.5 or older on WordPress sites. The plugin records its statistics in a database table and displays them on the Overview admin page, so any site running the vulnerable version is at risk. The CNA vendor product is NewStatPress by ice00.

The vulnerability has a CVSS score of 7.2, indicating a medium to high impact when exploited. The EPSS score is below 1%, suggesting a low probability of real‑world exploitation at the time of this assessment, and the issue is not listed in CISA's KEV catalog. Nevertheless, because the flaw grants attackers the ability to run code in an admin's browser, the potential for credential theft or further lateral movement remains significant. Attackers likely exploit the vulnerability by forcing a victim to visit a maliciously constructed URL; no authentication is required to record the payload.