CVE-2026-14845 NewStatPress CVE debrief

Who should care

Users of the NewStatPress WordPress plugin, particularly those with versions prior to 1.4.5, should review and update their installations to prevent potential Stored Cross-Site Scripting attacks. This includes operators, platform administrators, vulnerability management teams, and security teams who need to assess the impact of this vulnerability on their environments.

Technical summary

The NewStatPress WordPress plugin before 1.4.5 does not sanitise and escape data derived from unauthenticated visitor requests before storing it and later outputting it in one of its widgets, which could allow unauthenticated attackers to perform Stored Cross-Site Scripting attacks against users viewing the affected widget. Evidence from the NVD and WPScan suggests potential Stored Cross-Site Scripting vulnerability in NewStatPress WordPress plugin before version 1.4.5. The vulnerability has a CVSS score of 6.1 and is classified as MEDIUM severity. Defenders should review the official CVE record and NVD details for further information.

Defensive priority

Medium-priority defensive review recommended due to potential Stored Cross-Site Scripting attacks.

Recommended defensive actions

• Review and update NewStatPress WordPress plugin to version 1.4.5 or later
• Monitor for potential Stored Cross-Site Scripting attacks
• Implement additional security measures to prevent XSS attacks
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance.
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.

Evidence notes

The NewStatPress WordPress plugin before 1.4.5 does not sanitise and escape data derived from unauthenticated visitor requests before storing it and later outputting it in one of its widgets. Evidence from the NVD and WPScan suggests potential Stored Cross-Site Scripting vulnerability in NewStatPress WordPress plugin before version 1.4.5. Defenders should verify affected product deployments, review official advisories, and plan vendor-supported updates or mitigations.

Official resources