The WP Statistics – Simple, privacy-friendly Google Analytics alternative WordPress plugin is vulnerable to stored cross-site scripting (CWE-79) through the 'utm_campaign' parameter. This vulnerability affects all versions up to and including 14.16.8. The flaw is due to insufficient sanitization and escaping of user input, allowing unauthenticated attackers to inject arbitrary scripts. The injection is possible via the public /wp-statistics/v2/hit REST endpoint because the required signature is exposed publicly on the homepage, and a base64-encoded page_uri POST parameter overrides the sanitized REQUEST_URI, enabling the malicious utm_campaign value to be stored in the database and executed when accessed.

An unauthenticated attacker can inject and store malicious scripts that execute in the context of users visiting the affected pages, potentially leading to information disclosure or session hijacking. The CVSS 3.1 score is 7.2 (high), reflecting network attack vector, low attack complexity, no privileges required, no user interaction, and impact on confidentiality and integrity but not availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to the vulnerable REST endpoint if possible and monitor for suspicious activity. Avoid using affected versions in production environments.