The NewStatPress WordPress plugin fails to sanitize or escape content supplied by unauthenticated visitors before storing it to the database. When that stored data is later rendered in the Top Post Widget, the raw input is inserted directly into the page response, enabling malicious scripts to execute in the browsers of any user who views the widget. This flaw is a classic Stored Cross‑Site Scripting vulnerability, CVE‑2026‑14845.

Any WordPress site that has the NewStatPress plugin installed and uses a plugin version earlier than 1.4.5, particularly the Top Post widget, is vulnerable. Sites that deploy the plugin on a public‑facing WordPress installation without additional content‑security measures are at risk.

The CVSS score of 6.1 indicates a medium severity vulnerability that allows stored cross‑site scripting via unauthenticated requests. The EPSS score of less than 1% suggests a low probability of exploitation at this time, and it is not listed in the CISA KEV catalog, implying no known widespread exploitation. Nonetheless, a stored XSS can compromise any user who views the vulnerable widget, posing a threat to confidentiality and integrity. Based on the description the attack vector appears to be an unauthenticated web request that stores malicious payloads in the plugin’s database, followed by subsequent page loads by victim browsers.