What’s Vulnerable › Vulnerabilities
CVE-2026-14845: NewStatPress < 1.4.5 - Unauthenticated Stored XSS via Top Post Widget
- Severity: medium (CVSS 6.1 v3.1)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 0.3% probability of exploitation in the next 30 days
- Public exploit or detection template: none known
- Published: 2026-07-31 · updated 2026-08-26
- Weakness: CWE-79
Description
The NewStatPress WordPress plugin before 1.4.5 does not sanitise and escape data derived from unauthenticated visitor requests before storing it and later outputting it in one of its widgets, which could allow unauthenticated attackers to perform Stored Cross-Site Scripting attacks against users viewing the affected widget.
Affected products
- NewStatPress: before 1.4.5 — fixed in 1.4.5
How to fix
Upgrade to a fixed version: NewStatPress 1.4.5. Check the vendor advisory for mitigations.
References
Get alerted when CVE-2026-14845 or the next vulnerability affects your stack