CVE-2026-15780highexplotación observadaCWE-79

CVE-2026-15780: fallo de gravedad alta en veronalabs WP Statistics – Simple…

WP Statistics <= 14.16.8 - Unauthenticated Stored Cross-Site Scripting via 'utm_campaign' Parameter

Publicada el

Seguir esta CVE+ Monitorear WP Statistics – Simple, privacy-friendly Google Analytics alternative

Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.

43Vexday Risk Score

Prioriza la corrección. Ella explotación observada por VulnCheck.

ssvc Actcvss 7.2epss 0.6%
de la publicación al arma
Publicada en NVD19 ago
VulnCheck+1d
The WP Statistics – Simple, privacy-friendly Google Analytics alternative plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'utm_campaign' parameter in all versions up to, and including, 14.16.8 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The payload can be planted without authentication via the public /wp-statistics/v2/hit REST endpoint, because the required signature is exposed on the public homepage and a base64-encoded page_uri POST parameter overrides the previously sanitized REQUEST_URI, allowing the malicious utm_campaign value to bypass sanitization and be stored in the database.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N
Productos afectados
veronalabs · WP Statistics – Simple, privacy-friendly Google Analytics alternative
CVEs relacionadas — veronalabs WP Statistics – Simple…

En el mismo producto, de las más peligrosas a las menos.

CVE-2024-2194HIGHWP Statistics <= 14.5 - Unauthenticated Stored Cross-Site ScriptingEPSS 63.2%CVE-2025-9816HIGHWP Statistics <= 14.5.4 - Unauthenticated Stored Cross-Site Scripting via User-Agent HeaderEPSS 12.1%CVE-2026-5231HIGHWP Statistics <= 14.16.4 - Unauthenticated Stored Cross-Site Scripting via 'utm_source' ParameterEPSS 0.5%CVE-2021-4333MEDIUMWP Statistics <= 13.1.1 - Cross-Site Request Forgery to Arbitrary Plugin Activation and DeactivationEPSS 0.4%CVE-2026-3488MEDIUMWP Statistics <= 14.16.4 - Missing Authorization to Authenticated (Subscriber+) Sensitive Information Exposure and Privacy Audit ManipulationEPSS 0.3%CVE-2025-3953MEDIUMWP Statistics – The Most Popular Privacy-Friendly Analytics Plugin <= 14.13.3 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Plugin Settings UpdateEPSS 0.3%