CVE-2026-14845 — NewStatPress < 1.4.5 - Unauthenticated Stored XSS via Top Post Widget

CVE-2026-14845

NewStatPress < 1.4.5 - Unauthenticated Stored XSS via Top Post Widget PUBLISHED

Description (CNA)

The NewStatPress WordPress plugin before 1.4.5 does not sanitise and escape data derived from unauthenticated visitor requests before storing it and later outputting it in one of its widgets, which could allow unauthenticated attackers to perform Stored Cross-Site Scripting attacks against users viewing the affected widget.

Affected (CNA)

Vendor / product	Versions
Unknown / NewStatPress	affected 0 before 1.4.5

CWE

No CWE identifiers supplied.

References

https://wpscan.com/vulnerability/da5936d2-a96f-4ff8-8562-1248734f577f/

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.