CVE-2026-101924 NewStatPress <= 1.4.5 - Unauthenticated Stored Cross-Site Scripting via 'urlrequested' Attribute via Query String

The NewStatPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 1.4.5 via the 'Last referrers' meta box on the plugin's Overview admin page. This is due to insufficient output escaping of the visitor-supplied query string that the plugin record...

CVE-2026-101924: Improper Neutralization of Input During Web Page Generation

The NewStatPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 1.4.5 via the 'Last referrers' meta box on the plugin's Overview admin page. This is due to insufficient output escaping of the visitor-supplied query string that the plugin record...

PT-2026-113636

Name of the Vulnerable Software and Affected Versions NewStatPress versions prior to 1.4.6 Description Stored Cross-Site Scripting occurs via the 'Last referrers' meta box on the plugin's Overview admin page. The issue arises because the newstatpress generate overview lastreferrers function fails...