CVE-2026-15780

The WP Statistics plugin for WordPress has a security flaw that allows attackers to inject malicious code into web pages. This occurs when the plugin doesn't properly filter and sanitize user input, specifically the "utm_campaign" parameter, which can be exploited through the /wp-statistics/v2/hit REST endpoint. As a result, attackers can inject arbitrary web scripts that will run when a user visits the affected page, without needing to authenticate. The vulnerability can be exploited by sending a specially crafted request to the REST endpoint, which bypasses the plugin's input validation.

Based on public CVE data (MITRE/NVD).