CVE-2026-15780 describes a stored cross-site scripting vulnerability in the WP Statistics plugin for WordPress, affecting all versions up to 14.16.8. The flaw arises from improper neutralization of input during web page generation, specifically via the 'utm_campaign' parameter. An unauthenticated attacker can exploit the public /wp-statistics/v2/hit REST endpoint, which requires a signature exposed on the public homepage. By sending a base64-encoded page_uri POST parameter, the attacker overrides the sanitized REQUEST_URI, allowing malicious script payloads to be stored in the database and executed when users view the injected pages.

Successful exploitation allows unauthenticated attackers to inject and execute arbitrary JavaScript in the context of the affected site. This can lead to information disclosure, session hijacking, or other client-side attacks impacting users who visit the compromised pages. The vulnerability has a CVSS score of 7.2 (high severity) with network attack vector, low attack complexity, no privileges required, no user interaction, and partial impact on confidentiality and integrity.

No official patch or fix is currently referenced. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to the vulnerable REST endpoint if possible and monitor for suspicious activity. Avoid using affected versions and upgrade promptly once a patched version is released.