High · 7.1 CVE-2026-48839 EUVD-2026-33652GHSA-55x5-63j2-vmw4

WordPress WP Statistics plugin <= 14.16.6 - Cross Site Scripting (XSS) vulnerability

Published Jun 1, 2026 · Updated Jun 1, 2026 · Assigned by Patchstack

Description

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in VeronaLabs WP Statistics allows DOM-Based XSS.

This issue affects WP Statistics: from n/a through 14.16.6.

Vendor	Product	Affected	Fixed
VeronaLabs	WP Statistics	≤ 14.16.6	—