CVE-2026-100153Published
NewStatPress <= 1.4.5 - Unauthenticated Stored Cross-Site Scripting via URL Request Tracking (urlrequested field)
Explicit identifiers and source references
These records connect through source-stated identifiers. Shared identifiers or dates alone do not establish shared exposure, root cause or applicability.
CVE-2026-100153 · Microsoft / collected KEV context
cve-program · CVE-2026-100153
- https://www.wordfence.com/threat-intel/vulnerabilities/id/fe3a7196-690b-45bb-a34f-05981f6780f1?source=cve
- https://plugins.trac.wordpress.org/browser/newstatpress/tags/1.4.5/includes/nsp-core.php#L876
- https://plugins.trac.wordpress.org/browser/newstatpress/tags/1.4.5/newstatpress.php#L839
- https://plugins.trac.wordpress.org/browser/newstatpress/tags/1.4.5/newstatpress.php#L1453
Related operational evidence
Explicit CVE identifiersNo related operational record is retained in the current change model.