CVE-2026-15780

Name of the Vulnerable Software and Affected Versions WP Statistics versions prior to 14.16.9

Description Insufficient input sanitization and output escaping allow unauthenticated attackers to perform Stored Cross-Site Scripting. Attackers can inject arbitrary web scripts that execute when a user accesses an affected page. The injection is possible via the /wp-statistics/v2/hit REST endpoint, where a base64-encoded page uri POST parameter overrides the sanitized REQUEST URI, enabling a malicious utm campaign value to bypass security checks and be stored in the database. This is facilitated by the fact that the required signature is exposed on the public homepage.

Recommendations Update to a version newer than 14.16.8. Restrict access to the /wp-statistics/v2/hit REST endpoint to minimize the risk of exploitation.