CVE-2026-5231 is a stored cross-site scripting vulnerability in the WP Statistics WordPress plugin (up to version 14.16.4). The vulnerability arises from insufficient input sanitization and output escaping of the 'utm_source' parameter. Specifically, the plugin's referral parser copies the raw 'utm_source' value into a field that is later rendered into admin page HTML via innerHTML without escaping, allowing script injection. This affects the Referrals Overview and Social Media analytics pages in the admin interface and can be exploited by unauthenticated attackers.

Successful exploitation allows an unauthenticated attacker to execute arbitrary JavaScript in the context of the WordPress admin pages viewed by administrators. This can lead to theft of admin session cookies, unauthorized actions, or other malicious activities limited to the admin interface. The CVSS score of 7.2 reflects high severity with network attack vector, no privileges required, and impact on confidentiality and integrity.

Patch status is not yet confirmed — no official fix or patch links are currently available. Administrators should monitor the vendor's advisory for updates. Until a patch is released, restricting access to the WordPress admin interface and validating or sanitizing 'utm_source' inputs externally may reduce risk. Avoid visiting the Referrals Overview or Social Media analytics pages with untrusted data inputs. No vendor advisory content is available to indicate if any temporary or official fixes exist.