The MCB Stats WordPress plugin fails to sanitise or escape HTTP request header values before storing and later rendering them in the admin statistics grid. This flaw allows an unauthenticated attacker to insert malicious JavaScript that is executed when the statistics page is viewed, effectively creating a stored cross‑site scripting vulnerability within the administrative interface.

WordPress sites running the MCB Stats plugin version 1.0.0 or earlier are affected. No specific vendor other than "MCB" is listed as the product owner.

The CVSS score is not provided and the EPSS score is unavailable, while the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is sending a crafted HTTP request containing a malicious User‑Agent header to a site that stores that header; the stored payload then executes in any administrator's browser session that views the statistics page. As the attack is unauthenticated, the risk depends on the impact a malicious script can have on an admin session, including cookie theft, session hijacking, or arbitrary actions performed as an administrator.