Introduction
A single HTTP header can carry JavaScript that compromises WordPress admin accounts on over 600000 sites. WP Statistics, a widely deployed analytics plugin, is vulnerable to persistent cross-site scripting that requires no authentication and can be exploited at scale.
WP Statistics is a privacy-focused analytics plugin for WordPress, developed by VeronaLabs. It is one of the most popular plugins in its category, with over 600000 active installations. It gives site owners detailed visitor analytics without relying on external services, and that makes it a preferred choice for privacy-conscious administrators.
Technical Information
CVE-2025-9816 is a stored cross-site scripting vulnerability in WP Statistics, affecting all versions up to and including 14.5.4. The flaw is in how the plugin processes and displays the User-Agent header in its device analytics feature, in the file /includes/admin/templates/pages/devices/models.php at line 31.
When a visitor sends an HTTP request to a WordPress site running a vulnerable version, WP Statistics records the User-Agent header value for analytics. It does not sanitize this input before storing it in the WordPress database. Later, when an administrator opens the device analytics page, the plugin renders the stored User-Agent string directly into the page without output escaping. If the value contains malicious JavaScript, it will execute in the context of the admin user's browser session.
The vulnerability is classified as CWE-79 (Cross-site Scripting) and is a textbook example of stored XSS. The root cause is that the analytics reporting interface neither validates User-Agent data on input nor encodes it on output.
The relevant code is in the official plugin repository:
Affected Systems and Versions
- WP Statistics plugin for WordPress
- All versions up to and including 14.5.4
- Any WordPress site with the plugin enabled and device analytics reporting active is vulnerable
Vendor Security History
WP Statistics has a documented history of security issues. According to WPScan, at least 31 vulnerabilities have been reported over the plugin's lifetime, including earlier stored XSS and SQL injection flaws. In 2024, CVE-2024-2194 described a similar stored XSS vulnerability. VeronaLabs has patched previous issues, but the recurring problems with input sanitization and output escaping indicate persistent weaknesses in its secure development practices.
