CVE-2026-97652

Name of the Vulnerable Software and Affected Versions WP Statistics versions prior to 14.16.15

Description Insufficient input sanitization and output escaping allow unauthenticated attackers to perform Reflected Cross-Site Scripting. This occurs via the REQUEST URI query-parameter key, enabling the injection of arbitrary web scripts into pages that execute when a user is tricked into clicking a malicious link.

Recommendations Update to a version newer than 14.16.14.