Security Alert Summary
The WP Statistics – Simple, privacy-friendly Google Analytics alternative plugin for WordPress is vulnerable to a reflected Cross-Site Scripting (XSS) issue via the REQUEST_URI query-parameter key in all versions up to and including 14.16.14. Insufficient input sanitization and output escaping make it possible for an unauthenticated attacker to inject web scripts that execute if a user is tricked into performing an action such as clicking a crafted link.
CVE Details
- CVE ID: CVE-2026-97652
- Affected component: WP Statistics – Simple, privacy-friendly Google Analytics alternative (plugin)
- Affected versions: All versions up to and including 14.16.14
- Published: October 02, 2026 at 10:17:10 AM
- Last modified: October 02, 2026 at 1:18:55 PM
- CVSS v3.1 base score / severity / vector: 6.1 / MEDIUM /
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - Authentication / privileges / user interaction: None required / Privileges Required: NONE / User Interaction: REQUIRED
- Primary impact: Confidentiality: LOW; Integrity: LOW; Availability: NONE
- Scope: CHANGED
- Weakness: CWE-79 (Improper Neutralization of Input During Web Page Generation – Cross-site Scripting)
Technical Details
The vulnerability is a reflected Cross-Site Scripting (XSS) issue triggered by handling of the REQUEST_URI query-parameter key. According to the reported details, input coming from the request is not sufficiently sanitized or escaped before being included in pages, which allows an attacker to craft a URL containing a malicious script. If a target user clicks that URL, the injected script can execute in the context of the victim’s browser.
Repository and file references point to JavaScript and admin page source files in the plugin (for example, generator.js and ReferralsPage.php in the 14.16.14 tag). These references indicate the problematic handling occurs in code paths used to render referral or related admin output where REQUEST_URI data is reflected without proper escaping. The report does not describe an authenticated requirement, and the CVSS data indicates an unauthenticated attacker can induce execution only when a user interacts with the crafted link.
Impact is limited to what reflected XSS can achieve in the affected context: execution of arbitrary script in a victim’s browser session, which can lead to information disclosure accessible to the browser (for example, reading displayed data or performing actions the user can perform), or leveraged for social engineering. The available data does not indicate server-side code execution or direct modification of server files.
How This Could Impact Your Website
Consider a small site with an owner, an internal editor, and external contributors who manage content. An attacker could send a crafted link to one of these users (for example, via email or instant message). If that user clicks the link while logged into the WordPress admin area or while viewing affected pages, the injected script could run in their browser. Practical consequences include exposure of information visible in the browser (such as internal user email addresses displayed on admin pages) or actions taken on behalf of the user within their browser session.
This increases the risk of targeted phishing or social engineering against staff or contractors who have access to the site. If youre unsure whether your site is affected or how to assess your current user roles and plugins, it may be worth having a professional review of your setup.
Recommended Actions
- Update the affected plugin as soon as a patched version is available.
- Review and reduce unnecessary user roles, especially contributor-level accounts and other low-privilege accounts that have access to admin pages.
- Enforce strong passwords and enable two-factor authentication for editors and administrators.
- Remove unused or unmaintained plugins to reduce attack surface.
- Monitor site activity and logs for unusual behavior, such as unexpected admin page views or unfamiliar IP addresses accessing admin pages.
If youd like help reviewing your plugins, user roles, or overall WordPress security posture, our team at Freshy is happy to help.
References
- https://github.com/wp-statistics/wp-statistics/pull/1148
- https://plugins.trac.wordpress.org/browser/wp-statistics/tags/14.16.14/assets/dev/javascript/filters/generator.js#L383
- https://plugins.trac.wordpress.org/browser/wp-statistics/tags/14.16.14/assets/dev/javascript/filters/generator.js#L392
- https://plugins.trac.wordpress.org/browser/wp-statistics/tags/14.16.14/src/Abstracts/MultiViewPage.php#L82
- https://plugins.trac.wordpress.org/browser/wp-statistics/tags/14.16.14/src/Service/Admin/Referrals/ReferralsPage.php#L258
- https://plugins.trac.wordpress.org/browser/wp-statistics/tags/14.16.14/src/Service/Admin/Referrals/ReferralsPage.php#L283
- https://plugins.trac.wordpress.org/browser/wp-statistics/tags/14.16.14/src/Service/Admin/Referrals/ReferralsPage.php#L310
- https://plugins.trac.wordpress.org/changeset/3722421/wp-statistics/trunk/src/Service/Admin/Referrals/ReferralsPage.php
- https://plugins.trac.wordpress.org/changeset?reponame=&new=3722421%40wp-statistics%2Ftags%2F14.16.15&old=3702973%40wp-statistics%2Ftags%2F14.16.14
- https://www.wordfence.com/threat-intel/vulnerabilities/id/8f1d2fe2-816b-46ee-8ab5-ae9936ac9ded?source=cve
