Description
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in VeronaLabs WP Statistics wp-statistics allows Reflected XSS.This issue affects WP Statistics: from n/a through 14.16.14.
Published: 2026-10-04
Score: 7.1 High
EPSS: n/a
KEV: No
Impact: Cross‑Site Scripting (Reflected XSS)
Action: Patch
AI Analysis

Impact

This vulnerability arises from improper neutralization of input during web page generation, allowing reflected XSS attacks. An attacker can craft malicious input that is echoed back in a response, injecting executable scripts into the victim’s browser. Such execution can lead to session hijacking, credential theft, defacement, or other client‑side compromises, as documented by CWE‑79.

Affected Systems

The VeronaLabs WP Statistics plugin for WordPress, versions up through 14.16.14, are vulnerable. The latest patch is version 14.16.15 and later.

Risk and Exploitability

The CVSS score of 7.1 indicates high severity. No EPSS score is available, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector involves a crafted URL that, when visited by a user, reflects malicious input into the browser. Attackers could embed the URL in emails, social media, or other channels to reach unsuspecting users.

Generated by OpenCVE AI on October 4, 2026 at 10:52 UTC.

Remediation

Vendor Solution

Update the WordPress WP Statistics plugin to the latest available version (at least 14.16.15).

OpenCVE Recommended Actions

  • Upgrade the WP Statistics plugin to version 14.16.15 or later.
  • Check for other plugins or themes that echo user input and apply appropriate sanitization or updates if necessary.
  • Conduct a post‑upgrade security scan for reflected XSS to confirm remediation.

Generated by OpenCVE AI on October 4, 2026 at 10:52 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Sun, 04 Oct 2026 09:00:00 +0000

Type Values Removed Values Added
Description Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in VeronaLabs WP Statistics wp-statistics allows Reflected XSS.This issue affects WP Statistics: from n/a through 14.16.14.
Title WordPress WP Statistics plugin <= 14.16.14 - Cross Site Scripting (XSS) vulnerability
Weaknesses CWE-79
References
Metrics cvssV3_1

{'score': 7.1, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L'}

Subscriptions

No data.

cve-icon MITRE

Status: PUBLISHED

Assigner: Patchstack

Published:

Updated: 2026-10-04T07:00:43.091Z

Reserved: 2026-09-24T10:23:19.165Z

Link: CVE-2026-97276

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-10-04T09:16:39.640

Modified: 2026-10-04T09:16:39.640

Link: CVE-2026-97276

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-04T11:00:12Z

Weaknesses
  • CWE-79

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')