CVE-2026-14845 Overview
CVE-2026-14845 is a Stored Cross-Site Scripting (XSS) vulnerability affecting the NewStatPress WordPress plugin in versions prior to 1.4.5. The plugin fails to sanitize and escape data derived from unauthenticated visitor requests before storing it in the database. The stored data is later rendered in one of the plugin's widgets without proper output encoding. Unauthenticated attackers can inject malicious JavaScript that executes in the browsers of users viewing the affected widget. The flaw is categorized under [CWE-79] (Improper Neutralization of Input During Web Page Generation).
Critical Impact
Unauthenticated attackers can inject persistent JavaScript payloads that execute against site administrators and visitors, enabling session theft, credential harvesting, and administrative account takeover.
Affected Products
- NewStatPress WordPress plugin versions prior to 1.4.5
- WordPress installations exposing NewStatPress widgets to visitor traffic
- Sites where the NewStatPress widget is rendered to authenticated administrators
Discovery Timeline
- 2026-07-31 - CVE-2026-14845 published to NVD
- 2026-07-31 - Last updated in NVD database
Technical Details for CVE-2026-14845
Vulnerability Analysis
The NewStatPress plugin tracks visitor statistics by capturing request metadata from incoming HTTP traffic. This telemetry includes fields such as referrers, user agents, and search terms sourced from unauthenticated visitors. The plugin persists these values into the WordPress database without applying input sanitization. When the plugin later renders its widget, the stored values are output without HTML entity encoding or contextual escaping.
An attacker sends crafted HTTP requests containing JavaScript payloads in headers or query parameters that NewStatPress records. Once an administrator or visitor loads a page containing the affected widget, the injected script executes in their browser session. The stored nature of the injection makes it persistent across sessions until the database record is purged.
Root Cause
The root cause is missing input sanitization on unauthenticated request data before database storage, combined with missing output escaping when the widget renders stored values. WordPress provides functions such as sanitize_text_field() for input handling and esc_html() or esc_attr() for output contexts, none of which are applied to the affected code path.
Attack Vector
Exploitation requires no authentication and no privileges. The attacker sends an HTTP request to any page tracked by NewStatPress, embedding a JavaScript payload in a header or parameter that the plugin logs. User interaction is required only in the sense that a victim must load a page containing the vulnerable widget. Because the scope is changed, the injected script executes in the security context of the WordPress site, granting access to authenticated administrator sessions when an admin views the widget.
Verified proof-of-concept code is not publicly available. Refer to the WPScan Vulnerability Report for additional technical detail.
Detection Methods for CVE-2026-14845
Indicators of Compromise
- Unusual HTML tags or JavaScript strings such as <script>, onerror=, or javascript: present in NewStatPress database tables
- HTTP requests containing script payloads in User-Agent, Referer, or search query parameters logged by the plugin
- Unexpected outbound requests from administrator browsers to attacker-controlled domains after viewing dashboard widgets
- WordPress administrator sessions being reused from unfamiliar IP addresses following widget access
Detection Strategies
- Inspect NewStatPress plugin tables in the WordPress database for stored values containing HTML or JavaScript syntax
- Deploy web application firewall rules that flag script tags and event handlers in request headers and query strings
- Monitor administrator browser telemetry for anomalous script execution or DOM modifications on admin dashboard pages
- Compare the installed NewStatPress plugin version against the fixed release of 1.4.5 across all WordPress instances
Monitoring Recommendations
- Enable WordPress audit logging for plugin activity and administrator session events
- Alert on new outbound network connections initiated from WordPress administrator sessions to unrecognized domains
- Track HTTP request patterns targeting pages where NewStatPress widgets are rendered for repeated payload attempts
How to Mitigate CVE-2026-14845
Immediate Actions Required
- Update the NewStatPress WordPress plugin to version 1.4.5 or later on all affected WordPress installations
- Purge stored records in NewStatPress database tables that contain HTML or JavaScript payloads
- Rotate WordPress administrator credentials and invalidate active sessions if compromise is suspected
- Review recent administrative actions for unauthorized user creation, plugin installation, or configuration changes
Patch Information
The vendor has released NewStatPress version 1.4.5, which addresses the Stored XSS by sanitizing visitor-derived input before storage and escaping output when rendering widget content. Details are documented in the WPScan Vulnerability Report.
Workarounds
- Deactivate the NewStatPress plugin until the update to version 1.4.5 can be applied
- Remove the vulnerable widget from all public and administrative pages to prevent payload execution
- Apply a Content Security Policy (CSP) restricting inline script execution on WordPress admin and public pages
- Use a web application firewall to block requests containing script tags or JavaScript event handlers in headers and parameters
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
