The WP Statistics plugin fails to sanitize the utm_source parameter that is passed by external referral URLs. The raw value is written to a database field and later rendered inside an HTML legend via innerHTML without escaping, allowing an unauthenticated attacker to embed malicious JavaScript that will run in the browser of any administrator who visits the Referrals Overview or Social Media analytics pages. This Stored Cross‑Site Scripting can be used to hijack administrator sessions, steal data, or perform other malicious actions within the WordPress site.

WordPress sites that use the WP Statistics plugin from veronalabs, specifically versions up to and including 14.16.4.

The vulnerability carries a CVSS score of 7.2, indicating a high impact. No EPSS score is currently available and the issue is not listed in the CISA KEV catalog. An attacker can exploit the flaw by crafting a referral URL with a malicious utm_source value and directing legitimate traffic to that URL. When an administrator later accesses the compromised analytics page, the injected script executes in the administrator’s browser context, granting the attacker the ability to run arbitrary code within the bound of that session.