Vulnerability: The WP Statistics plugin through 12.6.5 for Wordpress has stored XSS in includes/class-wp-statistics-pages.php. This is related to an account with the Editor role creating a post with a title that contains JavaScript, to attack an admin user.
Vulnerability ID: CVE-2019-12566
CWE: CWE-79
Severity score: 2.9
Project: https://github.com/wp-statistics/wp-statistics
Published: 2019-06-03
File: includes/class-wp-statistics-pages.php
Commit message: Page's title should be encoded or filtering html entities/javascript code #271
Commit author: Mehrshad Darzi

Vulnerable version (before fix):
 public static function get_page_info( $page_id, $type = 'post' ) { 				case "post": 				case "page": 					$arg = array( 						'title'     => get_the_title( $page_id ), 						'link'      => get_the_permalink( $page_id ), 						'edit_link' => get_edit_post_link( $page_id ), 						'meta'      => array( public static function get_page_info( $page_id, $type = 'post' ) { 				case "tax": 					$term = get_term( $page_id ); 					$arg  = array( 						'title'     => $term->name, 						'link'      => ( is_wp_error( get_term_link( $page_id ) ) === true ? '' : get_term_link( $page_id ) ), 						'edit_link' => get_edit_term_link( $page_id ), 						'meta'      => array( public static function get_page_info( $page_id, $type = 'post' ) { 				case "author": 					$user_info = get_userdata( $page_id ); 					$arg       = array( 						'title'     => ( $user_info->display_name != "" ? $user_info->display_name : $user_info->first_name . ' ' . $user_info->last_name ), 						'link'      => get_author_posts_url( $page_id ), 						'edit_link' => get_edit_user_link( $page_id ), 					);

Fixed version (after fix):
 public static function get_page_info( $page_id, $type = 'post' ) { 				case "post": 				case "page": 					$arg = array( 						'title'     => esc_html( get_the_title( $page_id ) ), 						'link'      => get_the_permalink( $page_id ), 						'edit_link' => get_edit_post_link( $page_id ), 						'meta'      => array( public static function get_page_info( $page_id, $type = 'post' ) { 				case "tax": 					$term = get_term( $page_id ); 					$arg  = array( 						'title'     => esc_html( $term->name ), 						'link'      => ( is_wp_error( get_term_link( $page_id ) ) === true ? '' : get_term_link( $page_id ) ), 						'edit_link' => get_edit_term_link( $page_id ), 						'meta'      => array( public static function get_page_info( $page_id, $type = 'post' ) { 				case "author": 					$user_info = get_userdata( $page_id ); 					$arg       = array( 						'title'     => ( $user_info->display_name != "" ? esc_html( $user_info->display_name ) : esc_html( $user_info->first_name . ' ' . $user_info->last_name ) ), 						'link'      => get_author_posts_url( $page_id ), 						'edit_link' => get_edit_user_link( $page_id ), 					);

Patch:
patch: @@ -295,7 +295,7 @@ public static function get_page_info( $page_id, $type = 'post' ) {
 				case "post":
 				case "page":
 					$arg = array(
-						'title'     => get_the_title( $page_id ),
+						'title'     => esc_html( get_the_title( $page_id ) ),
 						'link'      => get_the_permalink( $page_id ),
 						'edit_link' => get_edit_post_link( $page_id ),
 						'meta'      => array(
@@ -308,7 +308,7 @@ public static function get_page_info( $page_id, $type = 'post' ) {
 				case "tax":
 					$term = get_term( $page_id );
 					$arg  = array(
-						'title'     => $term->name,
+						'title'     => esc_html( $term->name ),
 						'link'      => ( is_wp_error( get_term_link( $page_id ) ) === true ? '' : get_term_link( $page_id ) ),
 						'edit_link' => get_edit_term_link( $page_id ),
 						'meta'      => array(
@@ -327,7 +327,7 @@ public static function get_page_info( $page_id, $type = 'post' ) {
 				case "author":
 					$user_info = get_userdata( $page_id );
 					$arg       = array(
-						'title'     => ( $user_info->display_name != "" ? $user_info->display_name : $user_info->first_name . ' ' . $user_info->last_name ),
+						'title'     => ( $user_info->display_name != "" ? esc_html( $user_info->display_name ) : esc_html( $user_info->first_name . ' ' . $user_info->last_name ) ),
 						'link'      => get_author_posts_url( $page_id ),
 						'edit_link' => get_edit_user_link( $page_id ),
 					);
path: includes/class-wp-statistics-pages.php