CVE-2026-66426

HighCVSS 7.1

Published: 13/08/2026(UTC)Updated: 14/08/2026(UTC)Translated: 13/08/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.18%

8th percentile - higher than 8% of all known CVEs

Unauthenticated Cross Site Scripting (XSS) vulnerability in WP-Stats versions up to 2.56.

An attacker may inject malicious script that executes in the user's browser, potentially leading to session theft or account takeover.

Update the plugin to the latest version that includes a fix for the XSS vulnerability.

Original NVD description (English source)

Unauthenticated Cross Site Scripting (XSS) in WP-Stats <= 2.56 versions.