CVE-2025-13747

Name of the Vulnerable Software and Affected Versions NewStatPress versions prior to 1.4.4

Description Stored Cross-Site Scripting occurs due to insufficient input sanitization and output escaping on user supplied attributes. An authenticated attacker with contributor-level access or higher can bypass a regular expression in the nsp shortcode() function to inject arbitrary web scripts into pages. These scripts execute whenever a user visits the affected page.

Recommendations Update NewStatPress to version 1.4.4 or later. As a temporary mitigation, restrict user permissions to prevent contributors from editing pages using the nsp shortcode() function.