Unauthenticated Cross‑Site Scripting is present in WordPress WP Statistics plugin versions up to 14.16.13. The flaw allows an attacker to inject arbitrary JavaScript via malicious input or crafted URLs. When a visitor—either a regular user or an authenticated administrator—visits the vulnerable page, the script executes in their browser, potentially enabling session hijacking, credential theft, defacement, or further malicious payload execution.

The vulnerability affects the VeronaLabs WordPress WP Statistics plugin, specifically all releases version 14.16.13 and earlier.

The CVSS score of 7.1 classifies the flaw as high severity. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog, suggesting no public exploitation yet. The likely attack vector is remote and unauthenticated; an attacker only needs to entice a user to visit a crafted link or submit malicious input. Once the victim’s browser executes the injected script, the attacker can hijack the session or abuse privilege levels.