Exploit discussion active in current signal (4 latest mentions)
Recommended action window: High priority (within 72h)
NVD description
The WP Statistics – Simple, privacy-friendly Google Analytics alternative plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'utm_campaign' parameter in all versions up to, and including, 14.16.8 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The payload can be planted without authentication via the public /wp-statistics/v2/hit REST endpoint, because the required signature is exposed on the public homepage and a base64-encoded page_uri POST parameter overrides the previously sanitized REQUEST_URI, allowing the malicious utm_campaign value to bypass sanitization and be stored in the database.
Priority
LOW
Exploitation
NONE
PoC
YES
Patch
AVAILABLE
Momentum
NONE
CVE-2026-15780 The WP Statistics – Simple, privacy-friendly Google Analytics alternative plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'utm_campaign' par… https://www.cve.org/CVERecord?id=CVE-2026-15780
Post summary
WP Statistics WordPress plugin CVE‑2026‑15780 is a stored XSS vulnerability triggered via the 'utm_campaign' parameter; no PoC, exploit, patch, or active exploitation details are disclosed.
CVE-2026-15780 - Stored XSS in WP Statistics plugin ≤14.16.8 via utm_campaign param. Unauthenticated payload injection. CVSS 7.2. Unpatched - update/disable now. #CVE #WordPress #infosec https://www.valtersit.com/cve/CVE-2026-15780/ #CVE #infosec #SysAdmin #cybersecurity #Linux #devsecops #devops #developer #sysadmin #100daysofcode #git #github #gitlab #redteam #blueteam #ethicalhacker #ethicalhacking #cybersecurityawareness #cybersecurity #cybersecuritynews #cybersecuritytips #python #hacker #linux #kali #ubuntu #debian #ukraine #spain #ireland #unitedkingdom #canada #finland #estonia #lithuania #ireland #hungary #denmark #norway #malta #mexico #switczerland #iceland #israel
Post summary
The post discloses a stored XSS vulnerability in WP Statistics plugin (CVE‑2026‑15780), provides technical details and a CVSS score, and urges users to update or disable the plugin.
🚨*CVE* CVE-2026-15780 The WP Statistics – Simple, privacy-friendly Google Analytics alternative plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'utm_campaign' par… https://www.cve.org/CVERecord?id=CVE-2026-15780 ----- Traducción: CVE-2026-15780 El … https://infoflow.cloud`
Post summary
The brief tweet announces CVE-2026-15780 as a stored XSS flaw in the WP Statistics WordPress plugin and links to the official CVE record, but provides no proof of concept, exploit code, patch, or evidence of active exploitation.
CVE-2026-15780 Stored XSS in WP Statistics Plugin via utm_campaign Parameter https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-15780 Customizable Vulnerability Alerts: https://alerts.vulmon.com/?utm_source=twitter&utm_medium=social&utm_campaign=2102281&utm_content=4
Post summary
The text announces a Stored XSS vulnerability (CVE‑2026‑15780) in the WP Statistics Plugin that can be triggered via the utm_campaign parameter, providing a link to details but lacking PoC, exploit, patch, or active exploitation evidence.