EIP-2026-113923

The exploit demonstrates a persistent XSS vulnerability in the WordPress NewStatPress plugin (version 1.2.4) by injecting malicious JavaScript via the Referer header and a crafted GET request. The payload executes when an admin views the 'Last Visitors' or 'Visitors' tab.