WP Statistics <= 14.16.14 - Reflected Cross-Site Scripting via REQUEST_URI Query-Parameter Key

These records connect through source-stated identifiers. Shared identifiers or dates alone do not establish shared exposure, root cause or applicability.

CVE-2026-97652 · Microsoft / collected KEV context

cve-program · CVE-2026-97652

• https://www.wordfence.com/threat-intel/vulnerabilities/id/8f1d2fe2-816b-46ee-8ab5-ae9936ac9ded?source=cve
• https://plugins.trac.wordpress.org/browser/wp-statistics/tags/14.16.14/src/Service/Admin/Referrals/ReferralsPage.php#L258
• https://plugins.trac.wordpress.org/browser/wp-statistics/tags/14.16.14/src/Service/Admin/Referrals/ReferralsPage.php#L283
• https://plugins.trac.wordpress.org/browser/wp-statistics/tags/14.16.14/src/Service/Admin/Referrals/ReferralsPage.php#L310
• https://plugins.trac.wordpress.org/browser/wp-statistics/tags/14.16.14/src/Abstracts/MultiViewPage.php#L82
• https://plugins.trac.wordpress.org/browser/wp-statistics/tags/14.16.14/assets/dev/javascript/filters/generator.js#L383
• https://plugins.trac.wordpress.org/browser/wp-statistics/tags/14.16.14/assets/dev/javascript/filters/generator.js#L392
• https://github.com/wp-statistics/wp-statistics/pull/1148
• https://plugins.trac.wordpress.org/changeset?reponame=&new=3722421%40wp-statistics%2Ftags%2F14.16.15&old=3702973%40wp-statistics%2Ftags%2F14.16.14
• https://plugins.trac.wordpress.org/changeset/3722421/wp-statistics/trunk/src/Service/Admin/Referrals/ReferralsPage.php

No related operational record is retained in the current change model.