CVE-2026-19794

WP-Stats <= 2.56 - Unauthenticated Stored Cross-Site Scripting

Plugin URL

https://wordpress.org/plugins/wp-stats/

Description

Unauthenticated reflected XSS in the stats_author GET parameter of stats_page(). The sanitization filter strip_tags() is applied before urldecode(), allowing an attacker to bypass it by double URL-encoding the payload.

POC

1. Install and activate the WP-Stats plugin
2. Create a page or post with the [page_stats] shortcode
3. Navigate to: http://TARGET/PATH_TO_PAGE_OR_POST/?stats_author=%253Cscript%253Ealert(document.domain)%253C%252Fscript%253E