WordPress WP Statistics plugin <= 14.16.8 - Unauthenticated Stored Cross-Site Scripting via 'utm_campaign' Parameter vulnerability

Unauthenticated Stored Cross-Site Scripting via 'utmcampaign' Parameter vulnerability discovered by tipsen in WordPress Plugin WP Statistics versions = 14.16.8...

VulnCheck KEV: CVE-2026-15780

The WP Statistics – Simple, privacy-friendly Google Analytics alternative plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'utmcampaign' parameter in all versions up to, and including, 14.16.8 due to insufficient input sanitization and output escaping. This makes it...

CVE-2026-15780 WP Statistics <= 14.16.8 - Unauthenticated Stored Cross-Site Scripting via 'utm_campaign' Parameter

The WP Statistics – Simple, privacy-friendly Google Analytics alternative plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'utmcampaign' parameter in all versions up to, and including, 14.16.8 due to insufficient input sanitization and output escaping. This makes it...

CVE-2026-15780 WP Statistics <= 14.16.8 - Unauthenticated Stored Cross-Site Scripting via 'utm_campaign' Parameter

The WP Statistics – Simple, privacy-friendly Google Analytics alternative plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'utmcampaign' parameter in all versions up to, and including, 14.16.8 due to insufficient input sanitization and output escaping. This makes it...

CVE-2026-15780 WP Statistics <= 14.16.8 - Unauthenticated Stored Cross-Site Scripting via 'utm_campaign' Parameter

The WP Statistics – Simple, privacy-friendly Google Analytics alternative plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'utmcampaign' parameter in all versions up to, and including, 14.16.8 due to insufficient input sanitization and output escaping. This makes it...

CVE-2026-15780: Improper Neutralization of Input During Web Page Generation

The WP Statistics – Simple, privacy-friendly Google Analytics alternative plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'utmcampaign' parameter in all versions up to, and including, 14.16.8 due to insufficient input sanitization and output escaping. This makes it...

OLX: Reflective XSS at olx.ph

Hello, I would like to report a reflective XSS at https://www.olx.ph. Steps to reproduce Visit the following link: https://www.olx.ph/all-results?q=car&utmsource=OptHomepageVar0&utmmedium=Search&utmcampaign=toto%27-alertdocument.domain-%27-%27 An XSS should pop-up F305078 Technical Details The...