CVE-2022-0206: Newstatpress Project Newstatpress

Medium severity, CVSS 6.1. EPSS: 1.5% chance of exploitation in the next 30 days.

The NewStatPress WordPress plugin before 1.3.6 does not properly escape the whatX parameters before outputting them back in attributes, leading to Reflected Cross-Site Scripting issues

Affected products

• Newstatpress Project Newstatpress: before 1.3.6 (fixed in 1.3.6)

Published 2022-02-14. Last modified 2026-06-17.