CVE-2026-28175

CVE-2026-28175 is a cross-site scripting vulnerability in a WordPress visitor statistics plugin with an EPSS score of just 0.0018 despite a CVSS 7.1 rating. That gap is the story — and it's telling you something important about how exploitation probability models fail to account for admin-context vulnerabilities. Here's what matters: this plugin collects untrusted data from visitors — user agents, referrer strings, IP addresses — and renders it in an admin dashboard view. That single architectural decision converts an unauthenticated visitor input into a privilege escalation vector. An attacker doesn't need a complex exploit chain. They plant a payload in a referrer field, and when any administrator opens their traffic dashboard, that payload fires with full admin session cookies and capabilities. One hop, maximum blast radius. The low EPSS reflects narrow environmental fitness in scoring models, not low real-world risk. Standard exploitation probability treats technical complexity and deployment breadth as the primary variables. This vulnerability has neither — no complexity, and a data-aggregation plugin that stores visitor inputs in their raw form creates a single trust-crossing point. The scoring model sees 'simple XSS' and 'modest adoption' and discounts it. The reality is a single-hop compromise of the highest-privilege user in the system, using a dashboard meant to analyze traffic anomalies — meaning the compromised admin then uses the very tool being used to detect their own compromise. Check your WordPress installations for visitor statistics, referrer tracking, or geo-IP plugins. The specific version matters less than the architectural pattern: any plugin that ingests visitor-supplied data and renders it unchanged in an admin view is carrying the same mutation. Sanitization at ingestion — storing normalized data only — would eliminate this entire class. If you're maintaining such a plugin, audit your data model first; the secure approach should not be the hard one. The exploitation window may already have closed through rapid patching cycles in the WordPress ecosystem, but the architectural pattern persists across dozens of similar plugins — many in the 'entropy zone' of infrequent updates and fading maintenance. The low EPSS score gave defenders false comfort; treat the CVSS rating as the accurate signal.

Reviewed through automated stages and approved by a human before publication.