PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-97276 VeronaLabs CVE debrief

CVE-2026-97276 is a Cross-site Scripting vulnerability in WP Statistics, a WordPress plugin, affecting versions from n/a through 14.16.14. The vulnerability allows Reflected XSS and has a CVSS score of 7.1, classified as HIGH. The CVE record was published on 2026-10-04T09:16:39.640Z and has not been modified since then. The NVD entry is currently Received.

Vendor
VeronaLabs
Product
WP Statistics
CVSS
HIGH 7.1
CISA KEV
Not listed in stored evidence
Original CVE published
2026-10-04
Original CVE updated
2026-10-04
Advisory published
2026-10-04
Advisory updated
2026-10-04

Who should care

Defenders responsible for WordPress installations, especially those with untrusted user access, should assess exposure to this vulnerability and prioritize verification and remediation.

Why it matters

CVE-2026-97276 is a Cross-site Scripting vulnerability in WP Statistics, a WordPress plugin. Defenders should prioritize verifying exposure, especially for installations with untrusted user access, and consider upgrading to a fixed version.

  • Defenders need to verify exposure of WP Statistics installations to this vulnerability
  • Untrusted user access may be able to exploit this vulnerability for Reflected XSS
  • Remediation priority is high due to the HIGH CVSS score

Technical summary

The WP Statistics plugin for WordPress has a Cross-site Scripting vulnerability, allowing Reflected XSS. The vulnerability affects versions from n/a through 14.16.14 and has a CVSS score of 7.1. Defenders should verify exposure, especially for installations with untrusted user access, and consider upgrading to a fixed version. Confirm affected product deployments exist in managed environments and review official advisories for scope, severity, and guidance.

Defensive priority

Defenders should prioritize verifying exposure of WP Statistics installations to this vulnerability, especially those with untrusted user access.

Recommended defensive actions

  • Verify WP Statistics installations for exposure to this vulnerability
  • Assess user access and trust levels for WP Statistics
  • Consider upgrading to a fixed version of WP Statistics

Evidence notes

The CVE record and NVD detail page provide limited information about the vulnerability. Further verification is required to determine the actual impact and affected scope.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-97276 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-97276

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-97276 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-97276

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.