CVE-2026-14845

None

Open

TLP:CLEAR

NewStatPress < 1.4.5 - Unauthenticated Stored XSS via Top Post Widget

NVD CVE.org

AI Analysis

No AI analysis yet.

Description

The NewStatPress WordPress plugin before 1.4.5 does not sanitise and escape data derived from unauthenticated visitor requests before storing it and later outputting it in one of its widgets, which could allow unauthenticated attackers to perform Stored Cross-Site Scripting attacks against users viewing the affected widget.

Details

EPSS Score ⓘ: 0.16%

5.9th percentile
Confidence: 90%
Published: Jul 31, 2026
Last Modified: Jul 31, 2026

Notes

0

Log in to add a note

No notes yet. Click "Add Note" to create the first analysis note.

Opinions

0

Log in to add an opinion

No opinions yet. Be the first to assess this intelligence.