CVE-2026-5231
Published: 17 April 2026
Summary
CVE-2026-5231 is a high-severity Cross-site Scripting (CWE-79) vulnerability in Wordpress (inferred from references). Its CVSS base score is 7.2 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 14.5th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-15 (Information Output Filtering).
Deeper analysis
CVE-2026-5231 is a stored cross-site scripting (XSS) vulnerability in the WP Statistics plugin for WordPress, affecting all versions up to and including 14.16.4. The flaw stems from insufficient input sanitization and output escaping of the 'utm_source' parameter. The plugin's referral parser copies the raw utm_source value into the source_name field when a wildcard channel domain matches, and the chart renderer subsequently inserts this value into legend markup via innerHTML without escaping.
Unauthenticated attackers can exploit this vulnerability remotely with low attack complexity and no user interaction or privileges required. By crafting malicious utm_source values, they can inject arbitrary web scripts that persist and execute in the context of admin pages, specifically when an administrator views the Referrals Overview or Social Media analytics pages. The CVSS v3.1 base score is 7.2 (AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N), mapped to CWE-79.
References to the plugin's source code highlight the vulnerable locations in assets/dev/javascript/chart.js (line 498) and src/Service/Analytics/Referrals/ReferralsParser.php (line 62) across the 14.16.4 tag and trunk. A changeset from revision 3483860 to 3503795 in the trunk repository indicates a patch addressing the issue, suggesting mitigation through updating to a fixed version of the plugin.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-23342
Vulnerability details
The WP Statistics plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'utm_source' parameter in all versions up to, and including, 14.16.4. This is due to insufficient input sanitization and output escaping. The plugin's referral parser copies the…
more
raw utm_source value into the source_name field when a wildcard channel domain matches, and the chart renderer later inserts this value into legend markup via innerHTML without escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in admin pages that will execute whenever an administrator accesses the Referrals Overview or Social Media analytics pages.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Stored XSS in public-facing WordPress plugin directly enables remote exploitation of the web application (T1190). The flaw allows injection and execution of arbitrary JavaScript in admin browser context (T1059.007).
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
SI-10 requires validation of the utm_source input parameter to prevent storage of malicious scripts in the source_name field.
SI-15 mandates output filtering and escaping when inserting source_name into chart legend markup via innerHTML, blocking XSS execution on admin pages.
SI-2 ensures timely remediation by applying the plugin patch (changeset 3483860 to 3503795) to eliminate the sanitization and escaping flaws.