NewStatPress

NewStatPress has 13 disclosed vulnerabilities in the WordSec catalog, reported between 2015 and 2026; 11 are fixed and 2 remain unpatched as of October 2026. Their average CVSS score is 7.3, and the most serious one scores 9.8 out of 10. Severity breakdown: 2 critical and 6 high. 2015 was the busiest year with 7 disclosures.

The most common weakness is Cross-Site Scripting, behind 10 of the records (77%). Other recurring categories include SQL Injection.

11 of the records (85%) have a vendor fix, while 2 remain unpatched. The oldest unresolved one dates back to 2026.

9 independent researchers contributed these findings, most of them (3) reported by James Hooker.

Strategic Overview

Avg CVSSHigh

7.3/ 10

Patch Coverage85%

Open

Fixed

Get automatic notifications for all NewStatPress vulnerabilities before they are exploited.

Most severe open issueCVSS 7.2CVE-2026-101924

NewStatPress <= 1.4.5 - Unauthenticated Stored Cross-Site Scripting via 'urlrequested' Attribute via Query String

Read the full analysis

Vulnerability Records

13 records


2026-10-13 15:41	NewStatPress <= 1.4.5 - Unauthenticated Stored Cross-Site Scripting via 'urlrequested' Attribute via Query String NewStatPress <= 1.4.5	`CVE-2026-101924`	7.2 High	zickzick2	No
2026-10-13 15:38	NewStatPress <= 1.4.5 - Unauthenticated Stored Cross-Site Scripting via URL Request Tracking (urlrequested field) NewStatPress <= 1.4.5	`CVE-2026-100153`	7.2 High	Md. Moniruzzaman Prodhan (NomanProdhan)	No
2026-08-04 00:00	NewStatPress < 1.4.5 - Unauthenticated Stored Cross-Site Scripting NewStatPress < 1.4.5	`CVE-2026-14845`	7.2 High	ApogeeBytes	Yes
2025-12-11 14:35	NewStatPress <= 1.4.3 - Authenticated (Contributor+) Stored Cross-Site Scripting NewStatPress <= 1.4.3	`CVE-2025-13747`	6.4 Medium	Muhammad Yudha - DJ	Yes
2022-01-13 00:00	NewStatPress <= 1.3.5 - Reflected Cross-Site Scripting NewStatPress < 1.3.6	`CVE-2022-0206`	6.1 Medium	Krzysztof Zając	Yes
2017-03-01 00:00	NewStatPress < 1.2.5 - Unauthenticated Stored Cross-Site Scripting NewStatPress < 1.2.5	`CVE-2017-18575`	7.2 High	Han Sahin	Yes
2015-07-07 00:00	NewStatPress < 1.0.6 - SQL Injection NewStatPress < 1.0.6	`CVE-2015-9313`	9.8 Critical	James Hooker	Yes
2015-07-07 00:00	NewStatPress < 1.0.6 - Reflected Cross-Site Scripting NewStatPress < 1.0.6	`CVE-2015-9312`	6.1 Medium	James Hooker	Yes
2015-06-30 00:00	NewStatPress <= 1.0.3 - Stored Cross-Site Scripting NewStatPress <= 1.0.3	`CVE-2015-9314`	7.2 High	Michael Kapfer	Yes
2015-06-25 00:00	NewStatPress <= 1.0.6 - Reflected Cross-Site Scripting NewStatPress <= 1.0.6	`CVE-2015-9311`	6.1 Medium	James Hooker	Yes

Showing 1–10 of 13 reports