The NewStatPress WordPress plugin prior to version 1.4.5 does not properly sanitize and escape input derived from unauthenticated visitor requests before storing it and outputting it in one of its widgets. This results in a stored Cross-Site Scripting (CWE-79) vulnerability, enabling attackers to inject malicious scripts that execute when other users view the widget. The vulnerability has a CVSS 3.1 base score of 6.1, indicating a medium severity with network attack vector, low attack complexity, no privileges required, user interaction required, scope changed, and low impact on confidentiality and integrity but no impact on availability. No official patch or remediation level is currently documented, and no known exploits are reported in the wild.

Successful exploitation allows unauthenticated attackers to perform stored XSS attacks against users who view the affected widget, potentially leading to the execution of arbitrary scripts in their browsers. This can result in information disclosure or manipulation of user interactions within the affected WordPress site. The impact is limited to confidentiality and integrity with no availability impact.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider disabling the affected widget or restricting access to it to trusted users only. Monitoring for updates from the plugin vendor or WordPress security advisories is recommended.