CVE-2026-101924

7.2High

Published 14 Oct 2026 · NVD status: Deferred · AI triage by gemini-3.8-flash

7.2High

Attack vector: Network
Complexity: Low
Privileges needed: None
User interaction: None
Impact: Limited impact
Weakness: CWE-79

Impact

Unauthenticated attackers can execute arbitrary JavaScript in an administrator's browser to hijack admin sessions. The attacker only needs to send a crafted web request, then wait for an admin to view the Overview page and hover over the link.

Root cause

The newstatpress_generate_overview_lastreferrers() function places stored query strings into single-quoted href attributes using only FILTER_SANITIZE_URL, which fails to escape single quotes.

Affected systems

NewStatPress plugin for WordPress through version 1.4.5

CVSS v3.1 · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N

Fix & remediation

No fixed version is specified in the advisory; deactivate and delete the NewStatPress plugin immediately until a patched release is published.

shell

$ wp plugin deactivate newstatpress

AI-suggested. Run it in staging first and check it against the vendor advisory. Why?

Ad · In-content banner

NVD description

The NewStatPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 1.4.5 via the 'Last referrers' meta box on the plugin's Overview admin page. This is due to insufficient output escaping of the visitor-supplied query string that the plugin records in its statistics table: the newstatpress_generate_overview_lastreferrers() function concatenates the stored urlrequested value into a single-quoted href attribute after only FILTER_SANITIZE_URL, which does not encode the apostrophe. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a high-privileged user, such as an administrator, accesses the Overview page and hovers the injected link.

References

Source: nvd.nist.gov/vuln/detail/CVE-2026-101924