Unauthenticated stored XSS in VeronaLabs WP Statistics

Unauthenticated Cross Site Scripting (XSS) in WP Statistics <= 14.16.11 versions.

• VeronaLabs WP Statistics package wp-statistics: versions <= 14.16.11 are marked affected.
• Version 14.16.12 is marked unaffected in the record and is the confirmed fixed boundary.
• The default status is recorded as unaffected outside the affected range above. No additional product branches or parallel deployments are confirmed by the record.

VeronaLabs WP Statistics is affected by Improper Neutralization of Input During Web Page Generation, classified as Cross-Site Scripting (CWE-79). The CNA record classifies the issue as stored XSS in the WordPress wp-statistics package. An attacker does not need to authenticate, and the issue is reachable over the network; successful exploitation still requires user interaction with affected content. When malicious script content is stored and later rendered in a browser, it may execute in the context of the visitor or relevant user. The record does not identify the vulnerable parameter, endpoint, data field, or exact storage and rendering path.

The flaw is network reachable without authentication, and the attack characterization identifies low complexity. Exploitation requires user interaction, such as a user visiting or interacting with content that contains malicious script. The supplied record marks public exploit as false. The returned CISA enrichment also records exploitation as none and automatable as no; this is an assessment from that source and does not prove exploitation is impossible.

The vulnerability allows attacker-controlled script content to execute in a browser after a user interacts with affected content. Realistic consequences may include disclosure of data available to the browser context, partial modification of displayed content, or actions performed on behalf of the user, depending on the victim's permissions and session. XSS may extend its effect to users or components beyond the vulnerable plugin, but the record does not identify the exact execution context, affected account types, or specific data that can be accessed. No availability impact is confirmed by the available evidence.

Successful exploitation may allow malicious scripts, redirects, advertisements, or HTML to be injected into content delivered by the website. This can damage website trust, redirect visitors, or expose them to unwanted content, and in some contexts may disclose data accessible to the victim's browser. XSS may also affect user accounts or sessions when the script executes in a suitable context. The available evidence does not identify a service-availability impact.

1. Update the WordPress WP Statistics plugin to version 14.16.12, which the record identifies as unaffected.
2. If an update cannot be applied immediately, use the Patchstack mitigation rule for this issue if it is available to the deployment. Treat this as temporary protection, not a replacement for updating.
3. After updating, verify the package and actual installed version on every WordPress site, then review plugin-generated pages for unexpected scripts, redirects, or HTML.
4. Do not assume that parallel release branches or versions not covered by the record are safe without corresponding vendor confirmation.

1. Inventory all WordPress sites and identify deployments that install the wp-statistics package.
2. Check the installed plugin version and compare it with the affected and fixed boundaries listed in affected_summary.
3. Review content produced by WP Statistics, public-facing pages, and user reports for unexpected scripts, redirects, advertisements, or HTML. These are investigation leads, not confirmed indicators for this vulnerability.
4. Review web server, WAF, and browser reports for unusual redirects or script content associated with the site; the absence of such log evidence does not prove that the site is safe.
5. If Patchstack is deployed, verify that its mitigation rule for this issue is active while remediation is pending.