CVE-2026-48839: WordPress WP Statistics plugin <= 14.16.6 - Cross Site Scripting (XSS) vulnerability

Synopsis

DOM-based cross-site scripting (XSS) in the WP Statistics WordPress plugin (versions up to and including 14.16.6) is reachable over the network without any authentication. An attacker crafts a malicious link or page that, when visited by a logged-in user, executes attacker-controlled JavaScript in the victim's browser session. Successful exploitation gives the attacker access to session tokens and the ability to modify page content or trigger actions on behalf of the victim. No fix version has been published yet; HarborGuard tracks the advisory and will surface a patched rebuild the moment upstream ships a fix.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the target over the network, as the attack vector is Network (AV:N); the vulnerable plugin is exposed via standard HTTP/HTTPS web traffic.

• AuthenticationNot required

  No account or credentials are needed on the target site to craft and deliver the malicious payload (PR:N).

• Victim interactionRequired

  A victim, typically a logged-in WordPress user or administrator, must click a crafted link or visit a malicious page to trigger the DOM-based XSS payload (UI:R).

• Attack complexityDetail

  Attack complexity is Low (AC:L), meaning the exploit is reliable and requires no special conditions, race timing, or environmental dependencies.

Blast Radius

• Attacker-controlled JavaScript executes in the victim's browser session, reading stored session cookies and authentication tokens.
• The attacker can silently perform actions on the WordPress admin interface on the victim's behalf, such as creating accounts or changing settings.
• Page content visible to the victim can be modified or replaced in real time, enabling phishing or credential-harvesting overlays.
• Confidentiality, integrity, and availability are each partially impacted (C:L, I:L, A:L), meaning data leakage, content tampering, and minor disruption to the user session are all within scope of a successful exploit.