CVE-2026-14845 in NewStatPress Plugin
Summary
by MITRE • 07/31/2026
The NewStatPress WordPress plugin before 1.4.5 does not sanitise and escape data derived from unauthenticated visitor requests before storing it and later outputting it in one of its widgets, which could allow unauthenticated attackers to perform Stored Cross-Site Scripting attacks against users viewing the affected widget.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 07/31/2026
The vulnerability identified in the NewStatPress WordPress plugin affects versions prior to 1.4.5 and represents a critical stored cross-site scripting flaw that enables unauthenticated attackers to inject malicious code into the plugin's widget functionality. This issue arises from insufficient sanitization and escaping of data originating from visitor requests, creating a persistent security weakness that can be exploited by remote attackers without requiring authentication credentials. The vulnerability specifically impacts the plugin's handling of user input within its widget components, where data flows from external sources directly into stored database fields before being rendered back to users.
The technical implementation of this flaw demonstrates a classic stored xss vulnerability pattern where malicious payloads are first stored in the application's database and then executed when legitimate users view the affected widget. Attackers can craft specially formatted requests containing javascript code or other malicious scripts that get processed through the plugin's data handling mechanisms without proper validation or encoding. This creates a persistent threat vector where the malicious content remains stored until explicitly removed, potentially affecting multiple users who access the compromised widget. The vulnerability operates at the intersection of input validation and output escaping failures, which aligns with CWE-79 (Cross-site Scripting) and CWE-116 (Improper Encoding or Escaping of Output).
From an operational perspective, this vulnerability presents significant risk to WordPress site administrators and their visitors, as it can be exploited by attackers to steal user sessions, deface websites, redirect traffic to malicious domains, or execute arbitrary code within the context of authenticated user sessions. The unauthenticated nature of the attack means that even sites with strong access controls remain vulnerable if the affected widget is accessible to public users. The impact extends beyond simple data theft as attackers can leverage this vector for more sophisticated attacks including credential harvesting, malware distribution, and establishing persistent access points within the target environment.
The security implications of this vulnerability extend into the broader ATT&CK framework where it maps to techniques such as T1059.007 (Command and Scripting Interpreter: JavaScript) and T1566.001 (Phishing: Spearphishing Attachment) as attackers can use the stored payload to execute malicious javascript in user browsers. Organizations should implement immediate mitigation measures including updating to version 1.4.5 or later, which would contain proper sanitization and escaping mechanisms for user input. Additional defensive strategies include monitoring widget access patterns, implementing content security policies, and conducting regular security assessments of third-party plugins to identify similar vulnerabilities that could compromise the overall security posture of WordPress installations.
This vulnerability exemplifies the critical importance of input validation and output escaping in web application security, particularly within plugin ecosystems where third-party code can introduce significant risks. The flaw demonstrates how seemingly minor security oversights in data handling can create persistent threats that affect entire user bases and underscores the necessity for comprehensive security testing of all components within web applications. Organizations should maintain updated inventories of all plugins and themes to quickly identify and remediate such vulnerabilities, while also implementing automated scanning solutions to detect similar issues across their digital infrastructure.