CVE-2026-14845

The CVE concerns the NewStatPress WordPress plugin (versions before 1.4.5). It allows unauthenticated attackers to trigger Stored XSS by submitting unauthenticated input that is stored and later rendered in a widget without proper sanitization/escaping. Impact affects users viewing the affected w...