CVE-2026-19794

CVE-2026-19794 is a stored cross-site scripting (XSS) flaw in the WP-Stats plugin for WordPress, present in all versions up to and including 2.56, caused by insufficient input sanitization and output escaping. Because the injection requires no authentication, an unauthenticated attacker can submit malicious web scripts that the plugin stores and renders on pages of the affected site. Whenever a user opens a page containing the injected payload, the attacker's script executes in that user's browser, potentially allowing session hijacking, administrative actions performed as the victim, or injection of malicious content (the CVSS scope-changed rating reflects the risk of compromising other users, including site admins). Any WordPress site running WP-Stats version 2.56 or earlier is affected. Exploitation has not been confirmed in the wild, in CISA's KEV catalog, or per EPSS (0.2% 30-day probability), but one public proof-of-concept is available on GitHub.

What to do: Update WP-Stats to a patched release newer than 2.56 as soon as the vendor publishes a fix; if no fixed version is available yet, deactivate the plugin until one ships. Audit pages rendered by the plugin (and related stored content such as comments or form fields) for unexpected scripts or injected HTML, and remove any payloads already stored on the site. Review web logs for unauthenticated requests targeting the plugin to check for signs of attempted exploitation.