NewStatPress < 1.3.6 - Reflected Cross-Site Scripting
18Vexday Risk Score
Patch soon. It has a working public exploit.
ssvc Attendepss 1.5%
exploitation probability
1.5%top 29% of all CVEs
observed exploitation
nono source reports it
The NewStatPress WordPress plugin before 1.3.6 does not properly escape the whatX parameters before outputting them back in attributes, leading to Reflected Cross-Site Scripting issues
Affected products
Unknown · NewStatPress