CVE-2026-97276: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in VeronaLabs WP Statistics

This vulnerability in VeronaLabs WP Statistics (versions >=0 and <14.16.15) is due to improper neutralization of input during web page generation, leading to reflected cross-site scripting (XSS). An attacker could exploit this flaw by crafting a malicious URL or input that is reflected in the web page without proper sanitization, potentially executing arbitrary scripts in the context of the victim's browser session.

Successful exploitation could allow an attacker to execute arbitrary scripts in the context of the affected user's browser, potentially leading to information disclosure, session hijacking, or other client-side impacts. The CVSS vector indicates network attack vector, low attack complexity, no privileges required, user interaction required, scope changed, and impacts on confidentiality, integrity, and availability at low to high levels.

No explicit patch or remediation details are provided in the input data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users should consider disabling or restricting access to the vulnerable plugin to mitigate risk.