CVE-2026-100153: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in ice00 NewStatPress

CVE-2026-100153 is a stored cross-site scripting vulnerability (CWE-79) in the NewStatPress WordPress plugin by ice00. The flaw exists due to insufficient input sanitization and output escaping of the QUERY_STRING / REQUEST_URI parameter in versions up to and including 1.4.5. An unauthenticated attacker can inject arbitrary scripts that execute when users visit pages containing the [NewStatPress type="Top Pages"] shortcode, provided the attacker's crafted URL accumulates enough hits to be listed in the top-N ranking. This vulnerability has a CVSS 3.1 score of 7.2 (high severity), with network attack vector, low attack complexity, no privileges or user interaction required, and impacts confidentiality and integrity with scope change.

Successful exploitation allows an unauthenticated attacker to execute arbitrary scripts in the context of the affected website, potentially leading to data theft or manipulation of site content for users viewing the injected page. The impact affects confidentiality and integrity but does not affect availability. The attack requires specific conditions, including the presence of the vulnerable shortcode on a public page and sufficient hits on the malicious URL to appear in the top pages list.

No official patch or fix is currently documented for this vulnerability. Users should monitor the vendor's advisory for updates. As a temporary mitigation, administrators should avoid placing the [NewStatPress type="Top Pages"] shortcode on publicly accessible pages until a fix is available. Additionally, restricting access to the affected pages or disabling the plugin may reduce exposure.