Description
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in VeronaLabs WP Statistics wp-statistics allows Reflected XSS.This issue affects WP Statistics: from n/a through 14.16.14.
Published: 2026-10-04
Score: 7.1 High
EPSS: < 1% Very Low
KEV: No
Impact: Cross‑Site Scripting (Reflected XSS)
Action: Patch
AI Analysis

Impact

This vulnerability arises from improper neutralization of input during web page generation, allowing reflected XSS attacks. An attacker can craft malicious input that is echoed back in a response, injecting executable scripts into the victim’s browser. Such execution can lead to session hijacking, credential theft, defacement, or other client‑side compromises, as documented by CWE‑79.

Affected Systems

The VeronaLabs WP Statistics plugin for WordPress, versions up through 14.16.14, are vulnerable. The latest patch is version 14.16.15 and later.

Risk and Exploitability

The CVSS score of 7.1 indicates high severity. No EPSS score is available, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector involves a crafted URL that, when visited by a user, reflects malicious input into the browser. Attackers could embed the URL in emails, social media, or other channels to reach unsuspecting users.

Generated by OpenCVE AI on October 4, 2026 at 10:52 UTC.

Remediation

Vendor Solution

Update the WordPress WP Statistics plugin to the latest available version (at least 14.16.15).

OpenCVE Recommended Actions

  • Upgrade the WP Statistics plugin to version 14.16.15 or later.
  • Check for other plugins or themes that echo user input and apply appropriate sanitization or updates if necessary.
  • Conduct a post‑upgrade security scan for reflected XSS to confirm remediation.

Generated by OpenCVE AI on October 4, 2026 at 10:52 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Mon, 05 Oct 2026 19:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Sun, 04 Oct 2026 22:15:00 +0000

Type Values Removed Values Added
First Time appeared Veronalabs
Veronalabs wp Statistics
Wordpress-extensions
Wordpress-extensions wp Statistics
Vendors & Products Veronalabs
Veronalabs wp Statistics
Wordpress-extensions
Wordpress-extensions wp Statistics

Sun, 04 Oct 2026 09:00:00 +0000

Type Values Removed Values Added
Description Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in VeronaLabs WP Statistics wp-statistics allows Reflected XSS.This issue affects WP Statistics: from n/a through 14.16.14.
Title WordPress WP Statistics plugin <= 14.16.14 - Cross Site Scripting (XSS) vulnerability
Weaknesses CWE-79
References
Metrics cvssV3_1

{'score': 7.1, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L'}

Subscriptions

Veronalabs Wp Statistics
Wordpress-extensions Wp Statistics
cve-icon MITRE

Status: PUBLISHED

Assigner: Patchstack

Published:

Updated: 2026-10-05T18:50:30.444Z

Reserved: 2026-09-24T10:23:19.165Z

Link: CVE-2026-97276

cve-icon Vulnrichment

Updated: 2026-10-05T18:50:26.879Z

cve-icon NVD

Status : Deferred

Published: 2026-10-04T09:16:39.640

Modified: 2026-10-06T15:04:25.990

Link: CVE-2026-97276

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-04T20:48:53Z

Weaknesses
  • CWE-79

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')