4 matches found
CVE-2026-101924
The NewStatPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 1.4.5 via the 'Last referrers' meta box on the plugin's Overview admin page. This is due to insufficient output escaping of the visitor-supplied query string that the plugin record...
CVE-2026-101924 NewStatPress <= 1.4.5 - Unauthenticated Stored Cross-Site Scripting via 'urlrequested' Attribute via Query String
The NewStatPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 1.4.5 via the 'Last referrers' meta box on the plugin's Overview admin page. This is due to insufficient output escaping of the visitor-supplied query string that the plugin record...
CVE-2026-101924
The NewStatPress plugin for WordPress (versions up to and including 1.4.5 ) is vulnerable to Stored Cross-Site Scripting (XSS) . The flaw exists in the 'Last referrers' meta box on the Overview admin page because the newstatpress_generate_overview_lastreferrers() function fails to properly escape...
EUVD-2026-100810
The NewStatPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 1.4.5 via the 'Last referrers' meta box on the plugin's Overview admin page. This is due to insufficient output escaping of the visitor-supplied query string that the plugin record...