CVE-2026-14845

CVE-2026-14845 is an unauthenticated stored XSS in NewStatPress, a WordPress statistics plugin. The vulnerability lives in how the plugin processes visitor data—headers, parameters, user agents, referrer strings—all funneled into storage before any validation occurs. That's not implementation-level negligence. That's a design choice that treats the entire internet as trusted input. The EPSS score of 0.00162 is misleading if you interpret low probability as low risk. The real issue is that the attack surface isn't a single input field—it's every interaction any user has with a running site. A stored XSS in a comment form requires a victim to load a specific page. A stored XSS in a statistics plugin fires on every dashboard load, every admin page view, every user session. The exploitation window isn't bound by any single request lifecycle. Once the payload executes in an authenticated admin session viewing the affected widget, the pivot is straightforward: admin access to a WordPress statistics plugin typically means access to aggregated query patterns, database prefixes, and the ability to install other plugins or modify themes. The stored XSS is the delivery mechanism for session-hijacking that opens access to the entire plugin architecture. That's the blast radius EPSS doesn't measure—it's not a probabilistic event, it's a deterministic path once an attacker decides this target is worth touching. The low EPSS score likely reflects attacker deprioritization rather than good patching. WordPress plugin ecosystems normalize this failure class so thoroughly that attackers move to higher-yield targets. But this market saturation doesn't reduce the impact of a successful exploit—it just makes exploitation more selective. For defenders: prioritize this patch regardless of the EPSS score. The plugin's architectural design means any successful stored XSS gives attackers persistent access to admin sessions and the data stream of every visitor the site has ever recorded. Check your WordPress installations for NewStatPress, verify the installed version against the patch, and monitor for any admin-level session anomalies. The temporal persistence of this vulnerability—living in a statistics tool that records data continuously—means the attack surface includes everything the site has ever logged and everything it will log.

Reviewed through automated stages and approved by a human before publication.