CVE-2026-101924
Deferred Deferred - Pending Action

Stored XSS in NewStatPress WordPress Plugin

Publication date: 2026-10-14

Last updated on: 2026-10-14

Assigner: Wordfence

Description
The NewStatPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 1.4.5 via the 'Last referrers' meta box on the plugin's Overview admin page. This is due to insufficient output escaping of the visitor-supplied query string that the plugin records in its statistics table: the newstatpress_generate_overview_lastreferrers() function concatenates the stored urlrequested value into a single-quoted href attribute after only FILTER_SANITIZE_URL, which does not encode the apostrophe. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a high-privileged user, such as an administrator, accesses the Overview page and hovers the injected link.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-14
Last Modified
2026-10-14
Generated
2026-10-19
AI Q&A
2026-10-14
EPSS Evaluated
2026-10-18
NVD
CVE-2026-101924
EUVD
EUVD-2026-100810

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
ice00 NewStatPress 0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-79 The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

The NewStatPress plugin for WordPress has a stored cross-site scripting (XSS) vulnerability in versions up to 1.4.5. It occurs in the 'Last referrers' meta box on the plugin's Overview admin page. The vulnerability arises because the plugin does not properly escape user-supplied data when generating links. Attackers can inject malicious scripts into stored URLs, which execute when an administrator views the Overview page and hovers over the injected link.

Detection Guidance

Check if the NewStatPress plugin version 1.4.5 or older is installed on your WordPress site. Inspect the plugin's Overview admin page for suspicious scripts in the 'Last referrers' meta box. Look for unexpected href attributes containing apostrophes or JavaScript code in the statistics table.

Impact Analysis

This vulnerability allows unauthenticated attackers to inject malicious scripts into your WordPress site. If exploited, these scripts can steal sensitive data, such as administrator session cookies, or perform actions on behalf of high-privileged users. It could lead to unauthorized access, data breaches, or defacement of your website.

Compliance Impact

This vulnerability could lead to data breaches, which may violate GDPR and HIPAA requirements for protecting personal and health data. Non-compliance with these regulations can result in significant fines, legal penalties, and reputational damage for organizations handling sensitive user data.

Mitigation Strategies

Update the NewStatPress plugin to the latest version immediately. If an update is unavailable, consider disabling or removing the plugin until a patch is released. Review the 'Last referrers' data for any malicious entries and remove them.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-101924. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart