Stored XSS in WP-Stats plugin for WordPress

Successful exploitation allows unauthenticated attackers to persistently inject arbitrary client-side script into affected WordPress pages. When those pages are viewed, the injected script executes in the victim's browser in the security context of the site. This can enable session theft, unauthorized actions performed on behalf of authenticated users, content manipulation, credential harvesting, and administrative compromise if a privileged user views the malicious content.

Until an update is available, reduce exposure by disabling the WP-Stats plugin or restricting access to functionality that accepts and displays untrusted input. Apply compensating controls such as web application firewall rules to block common XSS payloads where feasible, and limit administrative browsing of untrusted or user-supplied content. Monitoring for unexpected script injection in pages rendered by the plugin can help identify attempted exploitation.

Upgrade the WP-Stats plugin to a version newer than 2.56 once a vendor-fixed release is available. If a patched version has already been released, update immediately to that version or later. Review plugin-managed content for previously injected payloads and remove any malicious stored data after patching.