CVE-2026-48839: WP Statistics Unauthenticated Stored XSS (CVSS 7.2)

CVE-2026-48839 is a CVSS 7.2 Stored XSS in WP Statistics <= 14.16.6. Any visitor can inject scripts into admin pages by sending a crafted User-Agent header.