WP Statistics <= 14.16.8 - Unauthenticated Stored Cross-Site Scripting via 'utm_campaign' Parameter
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Cross-site scripting
- Confidentiality · integrity · availability
- Low · Low · None
- Fix status
- No fix listed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-79.
Summary
The WP Statistics – Simple, privacy-friendly Google Analytics alternative plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'utm_campaign' parameter in all versions up to, and including, 14.16.8 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The payload can be planted without authentication via the public /wp-statistics/v2/hit REST endpoint, because the required signature is exposed on the public homepage and a base64-encoded page_uri POST parameter overrides the previously sanitized REQUEST_URI, allowing the malicious utm_campaign value to bypass sanitization and be stored in the database.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- Yes
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| VeronaLabs | WP Statistics – Simple, privacy-friendly Google Analytics alternative | up to 14.16.8 | — | No fix listed | CNA |
- WP Statistics – Simple, privacy-friendly Google Analytics alternative VendorVeronaLabs Affected up to 14.16.8 Fixed in — No fix listed CNA
Remediation
No fixed version listed by the sources yet.
Timeline
- 2026-10-02 Threatist record created from CVE-2026-15780
- 2026-10-03 Alias added: GHSA-3hm7-m5p9-2h77
- 2026-10-19 EPSS moved to the 50th–90th percentile
References
Other 14
- https://www.wordfence.com/threat-intel/vulnerabilities/id/b5baecfe-ce0b-4cec-8462-bfd7eadd41e9?source=cve
- https://plugins.trac.wordpress.org/browser/wp-statistics/tags/14.16.8/views/components/tables/visitors.php#L94
- https://plugins.trac.wordpress.org/browser/wp-statistics/tags/14.16.8/views/components/tables/referred-visitors.php#L79
- https://plugins.trac.wordpress.org/browser/wp-statistics/tags/14.16.8/assets/dev/javascript/helper.js#L267
- https://plugins.trac.wordpress.org/browser/wp-statistics/tags/14.16.8/includes/api/v2/class-wp-statistics-api-hit.php#L78
- https://plugins.trac.wordpress.org/browser/wp-statistics/tags/14.16.8/includes/class-wp-statistics-helper.php#L1462
- https://plugins.trac.wordpress.org/browser/wp-statistics/tags/14.16.8/includes/class-wp-statistics-hits.php#L102
- https://plugins.trac.wordpress.org/browser/wp-statistics/tags/14.16.7/views/components/tables/visitors.php#L94
- https://plugins.trac.wordpress.org/browser/wp-statistics/tags/14.16.7/views/components/tables/referred-visitors.php#L79
- https://plugins.trac.wordpress.org/browser/wp-statistics/tags/14.16.7/assets/dev/javascript/helper.js#L267
- https://plugins.trac.wordpress.org/browser/wp-statistics/tags/14.16.7/includes/api/v2/class-wp-statistics-api-hit.php#L78
- https://plugins.trac.wordpress.org/browser/wp-statistics/tags/14.16.7/includes/class-wp-statistics-helper.php#L1462
- https://plugins.trac.wordpress.org/browser/wp-statistics/tags/14.16.7/includes/class-wp-statistics-hits.php#L102
- https://github.com/wp-statistics/wp-statistics/commit/6ab74427778b89c9e88471e9dd7407d9055a9b34
More VeronaLabs vulnerabilities
- TI-2022-08862 WP Statistics <= 13.1.5 Unauthenticated Blind SQL Injection via IP CVSS 3.1CRITICAL 9.8
- TI-2022-08861 WP Statistics <= 13.1.5 Unauthenticated Blind SQL Injection via current_page_id CVSS 3.1CRITICAL 9.8
- TI-2022-00433 WP Statistics <= 13.1.4 Unauthenticated Blind SQL Injection via exclusion_reason CVSS 3.1CRITICAL 9.8
- TI-2022-08998 WP Statistics <= 13.1.5 Unauthenticated Stored Cross-Site Scripting via IP CVSS 3.1HIGH 7.2
- TI-2023-00906 WP Statistics < 14.0 - Authenticated SQLi CVSS 3.1HIGH 8.8
- TI-2022-03873 WP Statistics < 13.2.9 - Authenticated SQLi CVSS 3.1HIGH 8.8
Sources
- CVE-2026-15780 · CVE Program
- CVE-2026-15780 · NVD
- FIRST EPSS
- GHSA-3hm7-m5p9-2h77 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences