CVE-2026-101924

The NewStatPress plugin for WordPress (versions up to and including 1.4.5 ) is vulnerable to Stored Cross-Site Scripting (XSS) . The flaw exists in the 'Last referrers' meta box on the Overview admin page because the newstatpress_generate_overview_lastreferrers() function fails to properly escape...

CVE-2026-101924 NewStatPress <= 1.4.5 - Unauthenticated Stored Cross-Site Scripting via 'urlrequested' Attribute via Query String

The NewStatPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 1.4.5 via the 'Last referrers' meta box on the plugin's Overview admin page. This is due to insufficient output escaping of the visitor-supplied query string that the plugin record...

CVE-2026-100153

The NewStatPress plugin for WordPress (versions up to and including 1.4.5 ) is vulnerable to Stored Cross-Site Scripting (XSS) . The root cause is insufficient input sanitization and output escaping of the 'QUERY_STRING / REQUEST_URI' parameter used for URL request tracking. This allows unauthent...

CVE-2026-100153 NewStatPress <= 1.4.5 - Unauthenticated Stored Cross-Site Scripting via URL Request Tracking (urlrequested field)

The NewStatPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'QUERYSTRING / REQUESTURI' parameter in all versions up to, and including, 1.4.5 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject...