CVE-2026-19794

HighCVSS 7.2

Published: 14/08/2026(UTC)Updated: 14/08/2026(UTC)Translated: 14/08/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.19%

9th percentile - higher than 9% of all known CVEs

Summary

The WP-Stats plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to and including 2.56 due to insufficient input sanitization and output escaping. This allows unauthenticated attackers to inject arbitrary web scripts on pages that will execute whenever a user accesses an injected page.

Risk Assessment

An attacker can inject malicious scripts that execute in the browsers of visitors, potentially leading to session theft, administrator account takeover, or malware distribution.

Recommendation

Update the WP-Stats plugin to the latest available version that includes the fix. If updating is not possible, consider temporarily disabling the plugin until the patch is applied.

Original NVD description (English source)

The WP-Stats plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 2.56 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.