CVE-2026-5231 is a stored cross-site scripting vulnerability in the WP Statistics plugin for WordPress, affecting all versions up to and including 14.16.4. The issue arises from insufficient input sanitization and output escaping of the 'utm_source' parameter. The plugin's referral parser copies the raw 'utm_source' value into the 'source_name' field when a wildcard channel domain matches. Later, the chart renderer inserts this value into legend markup using innerHTML without escaping, enabling injection of arbitrary scripts. An unauthenticated attacker can exploit this to inject scripts that execute in the context of admin pages such as the Referrals Overview or Social Media analytics pages when accessed by an administrator.

Successful exploitation allows unauthenticated attackers to execute arbitrary JavaScript in the context of WordPress admin pages viewed by administrators. This can lead to session hijacking, unauthorized actions, or disclosure of sensitive information accessible to the admin user. The vulnerability does not impact availability but compromises confidentiality and integrity of the admin interface.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, administrators should limit access to the affected analytics pages and consider disabling the WP Statistics plugin if possible. Monitoring for suspicious activity related to admin sessions is advisable. Avoid clicking on untrusted links containing crafted 'utm_source' parameters that could trigger the vulnerability.