CVE-2025-13747

MediumCVSS 6.4

Published: 12/12/2025(UTC)Updated: 07/10/2026(UTC)Translated: 08/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.23%

13th percentile - higher than 13% of all known CVEs

Summary

The NewStatPress plugin for WordPress in versions up to and including 1.4.3 is vulnerable to Stored Cross-Site Scripting via a regex bypass in the `nsp_shortcode` function due to insufficient input sanitization and output escaping on user-supplied attributes. This allows authenticated attackers with contributor-level access and above to inject arbitrary web scripts that execute when a user visits the injected page.

Risk Assessment

An attacker can execute arbitrary JavaScript in the victim's browser, potentially leading to session theft, redirects, or other attacks in the context of the site.

Recommendation

Update the NewStatPress plugin to a version newer than 1.4.3 as soon as it becomes available, and in the meantime limit the number of accounts with Contributor privileges.

Other vulnerabilities in NewStatPress

CVE-2026-14845Medium
The NewStatPress WordPress plugin before version 1.4.5 does not sanitize and escape data from unauthenticated visitor requests before storing and later outputting it in one of its widgets. This allows unauthenticated attackers to perform Stored Cross-Site Scripting attacks against users viewing the affected widget.

Original NVD description (English source)

The NewStatPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via a regex bypass in nsp_shortcode function in all versions up to, and including, 1.4.3 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS