CVE-2025-9816 is a stored cross-site scripting vulnerability in the WP Statistics plugin for WordPress, affecting all versions up to and including 14.5.4. The vulnerability is triggered by an unauthenticated attacker injecting malicious scripts via the User-Agent HTTP header. Due to improper input sanitization and output escaping, these scripts are stored and executed when a user accesses the injected page, potentially compromising user sessions or data. The vulnerability has a CVSS 3.1 base score of 7.2, reflecting network attack vector, low attack complexity, no privileges or user interaction required, and impacts confidentiality and integrity with no availability impact.

An attacker can inject and store malicious scripts that execute in the context of users viewing the affected pages, potentially leading to theft of sensitive information or session hijacking. The vulnerability affects confidentiality and integrity but does not impact availability. No known exploits are reported in the wild as of the publication date.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, consider applying temporary mitigations such as filtering or sanitizing User-Agent headers at the web server or application firewall level. Monitor for updates from veronalabs regarding patches or official mitigations.