CVE-2026-97652 veronalabs CVE debrief

Who should care

WordPress site administrators and defenders should assess exposure and apply patches or mitigations to prevent exploitation of this vulnerability. They should also monitor for suspicious activity related to REQUEST_URI Query-Parameter Key and verify input sanitization and output escaping in WP Statistics plugin.

Why it matters

The WP Statistics plugin for WordPress is vulnerable to Reflected Cross-Site Scripting, allowing unauthenticated attackers to inject arbitrary web scripts into pages. Defenders should assess exposure, apply patches, and monitor for suspicious activity.

• Defenders must verify WP Statistics plugin versions and apply patches to prevent exploitation.
• Site administrators should monitor for suspicious activity related to REQUEST_URI Query-Parameter Key.
• Successful exploitation allows unauthenticated attackers to inject arbitrary web scripts into pages.

Technical summary

The WP Statistics plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the REQUEST_URI Query-Parameter Key in all versions up to, and including, 14.16.14 due to insufficient input sanitization and output escaping. This vulnerability allows unauthenticated attackers to inject arbitrary web scripts into pages that execute if a user performs an action such as clicking on a link. The vulnerability has a CVSS score of 6.1 and is considered MEDIUM severity. The WP Statistics plugin is a simple, privacy-friendly Google Analytics alternative for WordPress.

Defensive priority

Medium priority for WordPress site administrators and defenders to assess exposure and apply patches or mitigations.

Recommended defensive actions

• Assess exposure of WP Statistics plugin versions up to 14.16.14
• Apply patches or updates to WP Statistics plugin
• Monitor for suspicious activity related to REQUEST_URI Query-Parameter Key
• Verify input sanitization and output escaping in WP Statistics plugin
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, including its CVSS score of 6.1 and MEDIUM severity. The WP Statistics plugin is affected by a Reflected Cross-Site Scripting vulnerability.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.