WordPress WP Statistics plugin <= 14.16.4 - Unauthenticated Stored Cross-Site Scripting via 'utm_source' Parameter vulnerability

Unauthenticated Stored Cross-Site Scripting via 'utmsource' Parameter vulnerability discovered by daroo in WordPress Plugin WP Statistics versions = 14.16.4...

EUVD-2026-23342

The WP Statistics plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'utmsource' parameter in all versions up to, and including, 14.16.4. This is due to insufficient input sanitization and output escaping. The plugin's referral parser copies the raw utmsource value into the...

CVE-2025-13072

The HandL UTM Grabber / Tracker WordPress plugin versions prior to 2.8.1 is vulnerable to Reflected Cross-Site Scripting (XSS) . The root cause is the insufficient sanitization and escaping of the utm_source parameter before it is outputted back to the page. An attacker could exploit this to exec...