CVE-2026-15780 in WP Statistics Plugin
Summary
by MITRE • 08/19/2026
The WP Statistics – Simple, privacy-friendly Google Analytics alternative plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'utm_campaign' parameter in all versions up to, and including, 14.16.8 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The payload can be planted without authentication via the public /wp-statistics/v2/hit REST endpoint, because the required signature is exposed on the public homepage and a base64-encoded page_uri POST parameter overrides the previously sanitized REQUEST_URI, allowing the malicious utm_campaign value to bypass sanitization and be stored in the database.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 08/19/2026
The vulnerability identified within the WP Statistics plugin for WordPress represents a critical security flaw classified as Stored Cross-Site Scripting, commonly referenced under CWE-79 in industry standard taxonomies. This specific weakness stems from insufficient input sanitization and output escaping mechanisms embedded within the application logic. The core of the issue lies in how the plugin handles data passed through the utm_campaign parameter during analytics tracking operations. Because the vulnerability allows for stored execution, malicious scripts are not merely executed transiently but are persisted within the database associated with specific pages or posts on the target WordPress site. This persistence ensures that every time an administrator or any authenticated user views the affected page containing the injected script, the payload executes in their browser context, potentially leading to session hijacking, credential theft, defacement of the website content, or further propagation of malware within the organization's network if the victim holds elevated privileges.
The exploitation vector for this vulnerability is particularly concerning due to its unauthenticated nature and the sophistication required to bypass existing security controls. Attackers can initiate the injection process without any form of authentication by targeting the public REST endpoint located at /wp-statistics/v2/hit. This endpoint is designed to receive hit data from visitors, but it lacks adequate validation for certain parameters. The attack relies on a specific technique involving base64 encoding and parameter overriding. An attacker crafts a POST request where the page_uri parameter is set to a base64-encoded value that decodes to a malicious REQUEST_URI string containing the harmful utm_campaign payload. When the plugin processes this request, it overrides the standard server variable with the decoded value, effectively bypassing the initial sanitization filters that would normally block such input. This manipulation allows the attacker to inject arbitrary JavaScript code directly into the database records associated with the site's analytics data.
From an operational perspective, this vulnerability aligns with several tactics and techniques described in the MITRE ATT&CK framework for enterprise security. Specifically, it relates to T1059.007, which covers Command and Scripting Interpreter via JavaScript, as well as T1189, Drive-by Client Compilation or Download if the payload leads to further downloads. The ability to execute scripts in the context of an administrator significantly escalates the risk profile from a simple defacement issue to a potential full site compromise. Once the script executes with admin privileges, it can interact with WordPress APIs to create new administrative users, modify core files, install malicious plugins, or exfiltrate sensitive data such as database credentials and user information. The impact is severe because WP Statistics is widely used for tracking visitor behavior, meaning many sites rely on its output for business intelligence, making the stored payload highly visible to key decision-makers who access these analytics dashboards regularly.
Mitigation strategies must address both immediate remediation and long-term defensive posture improvements. The most effective solution is to upgrade the WP Statistics plugin to a version later than 14.16.8 where this specific input validation flaw has been patched by the developers. Until an update can be applied, administrators should consider implementing Web Application Firewall rules that specifically block requests containing base64-encoded strings in the page_uri parameter when directed at the /wp-statistics/v2/hit endpoint. Additionally, enforcing strict Content Security Policy headers on WordPress sites can help mitigate the impact of any successful XSS attacks by restricting the sources from which scripts are allowed to execute. Regular security audits and code reviews focusing on REST API endpoints are essential to identify similar patterns where input data is decoded or transformed in ways that might bypass standard sanitization routines, ensuring that future updates maintain robust protection against injection-based threats.