Threat database

The NewStatPress WordPress plugin versions up to and including 1.4.5 contain a stored cross-site scripting (XSS) vulnerability in the 'Last referrers' meta box on the Overview admin page. This vulnerability arises from insufficient output escaping of user-supplied query strings recorded in the plugin's statistics table. An unauthenticated attacker can inject malicious scripts that execute when a high-privileged user views the Overview page and interacts with the injected link.

The NewStatPress WordPress plugin is affected by a stored Cross-Site Scripting (XSS) vulnerability in versions up to and including 1.4.5. This vulnerability arises from improper sanitization of the QUERY_STRING / REQUEST_URI parameter, allowing unauthenticated attackers to inject malicious scripts. Exploitation depends on an administrator placing the vulnerable shortcode on a public page and the attacker's crafted URL gaining enough hits to appear in the top pages list.

The NewStatPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via a regex bypass in nsp_shortcode function in all versions up to, and including, 1.4.3 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.