Executive brief
The NewStatPress WordPress plugin, which tracks and displays visitor statistics, contains a security flaw that allows unauthenticated visitors to inject malicious scripts into the website. These scripts are stored by the plugin and executed in the browsers of other users, including administrators, when they view the plugin's statistics widgets. This could lead to unauthorized actions being performed in a user's session or the theft of sensitive information.
Technical details
The NewStatPress plugin fails to properly sanitize and escape visitor-supplied data, specifically query strings, before storing them in the database and rendering them in the 'TopPosts' widget. An unauthenticated attacker can send crafted HTTP requests containing JavaScript payloads in the URL parameters (e.g., via the 'p=' parameter). When the widget retrieves these statistics via an AJAX call to 'admin-ajax.php', it injects the unescaped data into the page using innerHTML. This allows for the execution of arbitrary JavaScript in the context of any user viewing the affected widget. The vulnerability is fixed in version 1.4.5.
Affected products
- Unknown NewStatPress < 1.4.5
Timeline
- 2026-07-13: disclosed: Publicly published by researcher
- 2026-07-31: advisory: NVD publication date
- 2026-07-31: patched: Fixed in version 1.4.5