An unauthenticated stored Cross-Site Scripting vulnerability in the WP Statistics plugin for WordPress allows attackers to execute malicious scripts within the administrative interface, posing a significant risk of account compromise.

This is a stored Cross-Site Scripting (XSS) vulnerability caused by improper input sanitization and output escaping in the referral parser. Unauthenticated attackers can inject malicious scripts into the source_name field, which then execute when an administrator views the Referrals Overview or Social Media analytics pages.

The ability for an unauthenticated attacker to execute arbitrary scripts in the context of an administrator's browser can lead to full site compromise, unauthorized configuration changes, and the theft of administrative session cookies. With a CVSS score of 7.2, this vulnerability is classified as High severity, as it facilitates unauthorized control over the WordPress environment and potentially sensitive analytical data.

Immediate Action: Update the WP Statistics plugin to version 14.16.5 or higher to ensure the input sanitization and output escaping fixes are applied.

Proactive Monitoring: Monitor administrative access logs for unusual login patterns or unauthorized changes to plugin settings and site configuration.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to block malicious patterns in URL parameters, specifically targeting the utm_source field.

Public Exploit Available: No (exploit_available unknown).

This vulnerability presents a high risk to WordPress installations due to the ease of exploitation via unauthenticated network access. Administrators should prioritize updating the WP Statistics plugin immediately to prevent potential script execution within their administrative dashboards. Failure to patch allows attackers to potentially escalate privileges or steal sensitive session data, making rapid remediation essential.