The WP Statistics plugin, versions up to 14.16.8, is vulnerable to stored XSS through the 'utm_campaign' parameter. Attackers can place malicious JavaScript into that field via the public REST endpoint without authentication, because the endpoint accepts a base64‑encoded page_uri that overrides sanitization and the required signature is exposed on the homepage. The payload is then stored in the database and will be executed whenever a user visits a page containing the injected data, allowing arbitrary script execution in the victim’s browser.

Any WordPress installation that has the WP Statistics plugin by veronalabs installed and running a version 14.16.8 or earlier is affected.

The vulnerability has a CVSS score of 7.2, indicating high severity. EPSS is reported as less than 1 %, showing a low current risk of exploitation, and it is not listed in the CISA KEV catalog. The exploit path is internet‑facing, requiring no credentials and relying solely on the public /wp-statistics/v2/hit endpoint, making it straightforward for attackers to inject malicious scripts that persist for all site visitors.