CVE-2026-101924 in NewStatPress Plugin
Summary
by MITRE • 10/15/2026
The NewStatPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 1.4.5 via the 'Last referrers' meta box on the plugin's Overview admin page. This is due to insufficient output escaping of the visitor-supplied query string that the plugin records in its statistics table: the newstatpress_generate_overview_lastreferrers() function concatenates the stored urlrequested value into a single-quoted href attribute after only FILTER_SANITIZE_URL, which does not encode the apostrophe. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a high-privileged user, such as an administrator, accesses the Overview page and hovers the injected link.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 10/15/2026
The NewStatPress plugin for WordPress, specifically in versions up to 1.4.5, contains a critical security flaw classified as Stored Cross-Site Scripting within its administrative interface. This vulnerability is located in the Last referrers meta box on the Overview admin page and stems from insufficient output escaping of visitor-supplied data. The core technical issue lies in how the plugin handles URL strings recorded during normal operation. When generating the overview, the function newstatpress_generate_overview_lastreferrers() retrieves stored URLs from the statistics table and concatenates them into HTML anchor tags. While the developers attempted to sanitize this input using PHP's FILTER_SANITIZE_URL filter, this mechanism is fundamentally inadequate for preventing XSS attacks in this specific context because it does not encode single quotes or other special characters that can break out of attribute boundaries.
The technical flaw manifests when an unauthenticated attacker crafts a malicious URL containing JavaScript payload syntax wrapped in single quotes. Because the plugin stores these referrer URLs without properly escaping them for HTML output, the stored data retains its executable script components. When an administrator with high privileges accesses the Overview page to review traffic statistics, the browser parses the malformed href attribute. The lack of proper encoding allows the injected script to execute within the context of the admin dashboard whenever a user hovers over or interacts with the malicious link in the referrer list. This execution occurs under the security context of the logged-in administrator, granting the attacker elevated privileges equivalent to that user account.
From an operational impact perspective, this vulnerability poses severe risks to WordPress installations running affected versions. Since the attack requires no authentication for the initial injection phase and only triggers upon viewing by a privileged user, it is highly exploitable in public-facing environments where traffic logs are actively maintained. Successful exploitation can lead to complete compromise of the administrative account, including theft of session cookies, credential harvesting via keyloggers embedded in the injected script, or defacement of the admin interface. Furthermore, because the payload is stored server-side, every administrator who views the page becomes a potential victim without needing any direct interaction beyond loading the dashboard, significantly increasing the attack surface and likelihood of successful compromise.
This vulnerability aligns with CWE-79, which describes Improper Neutralization of Input During Web Page Generation commonly known as Cross-site Scripting. Specifically, it represents a stored variant where malicious data is persisted in the database and later rendered unsafely by the application. In terms of adversary tactics, this behavior corresponds to ATT&CK technique T1059, Command and Scripting Interpreter, particularly when used for initial access or persistence through compromised administrative sessions. The failure to properly encode output before insertion into HTML attributes highlights a common oversight in web development where input sanitization is mistaken for sufficient security control without considering the context of output encoding required by different markup contexts such as HTML attributes versus body text.
Mitigation strategies must address both immediate remediation and long-term defensive posture. Administrators should immediately update NewStatPress to version 1.4.6 or later, where this escaping issue has been resolved through proper use of htmlspecialchars with appropriate flags like ENT_QUOTES to ensure single quotes are encoded as HTML entities. Until an upgrade is possible, limiting access to the WordPress admin area via IP whitelisting can reduce exposure to unauthenticated attackers attempting to inject payloads. Additionally, implementing a Web Application Firewall that detects and blocks common XSS patterns in referrer headers may provide temporary protection against exploitation attempts. Long-term improvements involve adopting strict Content Security Policy directives to restrict script execution sources and ensuring all future development follows secure coding standards that mandate context-aware output encoding for every piece of user-supplied data rendered into HTML structures.