CVE-2026-101924

Name of the Vulnerable Software and Affected Versions NewStatPress versions prior to 1.4.6

Description Stored Cross-Site Scripting occurs via the 'Last referrers' meta box on the plugin's Overview admin page. The issue arises because the newstatpress generate overview lastreferrers() function fails to properly escape the visitor-supplied query string stored in the statistics table. Specifically, the urlrequested variable is concatenated into a single-quoted href attribute using only FILTER SANITIZE URL, which does not encode apostrophes. This allows unauthenticated attackers to inject arbitrary web scripts that execute when a high-privileged user, such as an administrator, accesses the Overview page and hovers over the injected link.

Recommendations Update to a version newer than 1.4.5. As a temporary workaround, restrict access to the Overview admin page to minimize the risk of exploitation.