CVE-2026-84774

MediumCVSS 6.1/10Last modified Sep 5, 2026

Description

Unauthenticated Cross Site Scripting (XSS) in WP Statistics <= 14.16.11 versions.

Metrics

CVSS 3.1 6.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

VendorProductVersions
VeronaLabsWP Statistics<= 14.16.11

References

Timeline

Published
Sep 3, 2026
Last modified
Sep 5, 2026
NVD status
Deferred

Related CVEs from 2026

CVE-2026-847755.3Unauthenticated Denial of Service Attack in Really Simple SSL <= 9.8.0 versions.CVE-2026-847767.5Unauthenticated Denial of Service Attack in MalCare Security <= 6.69 versions.CVE-2026-847777.4Unauthenticated Broken Authentication in Really Simple SSL <= 9.8.0 versions.CVE-2026-847787.5Unauthenticated Denial of Service Attack in Migrate Guru – Site Migration &amp; Cloning <= 6.65 versions.CVE-2026-847798.1Subscriber Broken Access Control in Agentimus – AI SEO, llms.txt &amp; MCP for AI Agents <= 1.51.0 versions.CVE-2026-84788.8IBM Langflow OSS 1.0.0 through 1.10.3 could allow a remote attacker to inject arbitrary code on the system, due to the improper control of uCVE-2026-847805.3Unauthenticated Denial of Service Attack in WP Go Maps <= 10.1.08 versions.CVE-2026-847816.5Contributor Cross Site Scripting (XSS) in Gallery PhotoBlocks <= 1.3.4 versions.CVE-2026-847828.2Issue summary: The DTLS retransmission logic does not correctly handle a handshake message write that is suspended part-way through. The retCVE-2026-847837.5Issue summary: The first concurrent use of the same X.509 certificate by several threads may cause its cached extension data to be freed whiCVE-2026-847847.5Issue summary: A malicious remote peer may flood the local QUIC stack with NEW_CONNECTION_ID frames by avoiding a limit check on how many coCVE-2026-847878.1ZohoCorp ManageEngine OpManager and Firewall Analyzer versions 12.8.710 and below were vulnerable to a Privilege Escalation vulnerability th
CVE-2026-84774: Medium severity, CVSS 6.1 | Vulnix