medium6.1
CVE-2026-14845
The NewStatPress WordPress plugin before 1.4.5 does not sanitise and escape data derived from unauthenticated visitor requests before storing it and later outp…
Impact
The NewStatPress WordPress plugin before 1.4.5 does not sanitise and escape data derived from unauthenticated visitor requests before storing it and later outputting it in one of its widgets, which could allow unauthenticated attackers to perform Stored Cross-Site Scripting attacks against users viewing the affected widget.
Affected products
| Product | Affected versions |
|---|---|
| NewStatPress WordPress Plugin | before 1.4.5 |
Versions were read from the advisory text. No structured product data has been published for this record yet.