Severity by source
AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:L
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:L
Lifecycle Timeline
2DescriptionCVE.org
The WPS Visitor Counter WordPress plugin through 1.4.8 does not escape the $_SERVER['REQUEST_URI'] parameter before outputting it back in an attribute, which could lead to Reflected Cross-Site Scripting in old web browsers.
AnalysisAI
Reflected cross-site scripting (XSS) in WPS Visitor Counter WordPress plugin through version 1.4.8 allows remote attackers to inject malicious scripts via the REQUEST_URI parameter, which is output without sanitization in HTML attributes. The vulnerability has a CVSS score of 5.8 and requires user interaction (clicking a crafted link), with exploitation limited primarily to older web browsers due to modern XSS protections. No public exploit code or active exploitation has been identified at the time of analysis.
Technical ContextAI
The vulnerability stems from improper input validation and output encoding in the WPS Visitor Counter plugin, specifically in how it processes the $_SERVER['REQUEST_URI'] superglobal variable. REQUEST_URI contains the raw URI requested by the client and, when reflected back into HTML attributes without proper escaping, allows attackers to break out of the attribute context and inject JavaScript. The vulnerability is classified as Reflected XSS (CWE category) because the malicious payload must be delivered via a specially crafted URL. Modern web browsers implement Content Security Policy (CSP) and other XSS filters that mitigate such attacks, which is why the vulnerability note specifically mentions 'old web browsers' as the primary attack surface. This is a server-side rendering issue where the WordPress plugin fails to use functions like esc_attr() or esc_url() before output.
Affected ProductsAI
WPS Visitor Counter WordPress plugin versions through 1.4.8 are affected. The plugin is distributed via the WordPress.org plugin repository. Affected installations include any WordPress deployment running this plugin at version 1.4.8 or earlier. The exact earlier vulnerable versions have not been independently confirmed from available data, but the advisory indicates the vulnerability exists through 1.4.8.
RemediationAI
Update the WPS Visitor Counter plugin to a version newer than 1.4.8 (exact patched version not specified in available advisory data, so refer to the official WordPress.org plugin page or WPScan vulnerability record for the latest available release). Site administrators should navigate to WordPress Dashboard > Plugins, locate WPS Visitor Counter, and click 'Update' if a newer version is available. As an interim workaround if immediate patching is not possible, disable the plugin or restrict access to the WordPress site through a Web Application Firewall (WAF) rule that sanitizes REQUEST_URI parameters. For additional details, refer to the WPScan vulnerability advisory at https://wpscan.com/vulnerability/fe2eb926-96e8-419e-bf41-5531546e6590/.
sapi/cgi/cgi_main.c in PHP before 5.3.12 and 5.4.x before 5.4.2, when configured as a CGI script (aka php-cgi), does not
(1) boardData102.php, (2) boardData103.php, (3) boardDataJP.php, (4) boardDataNA.php, and (5) boardDataWW.php in Netgear
ProjectSend versions prior to r1720 are affected by an improper authentication vulnerability. Rated critical severity (C
Roundcube Webmail contains a critical PHP object deserialization vulnerability (CVE-2025-49113, CVSS 9.9) that allows au
Util/PHP/eval-stdin.php in PHPUnit before 4.8.28 and 5.x before 5.6.3 allows remote attackers to execute arbitrary PHP c
Palo Alto Networks PAN-OS management web interface contains an authentication bypass allowing unauthenticated attackers
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
The get_referers function in /opt/ws/bin/sblistpack in Sophos Web Appliance before 3.7.9.1 and 3.8 before 3.8.1.1 allows
The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
NetAlertX (formerly PiAlert) versions 23.01.14 through 24.x before 24.10.12 allow unauthenticated command injection thro
The GiveWP - Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to PHP Object Injection in all
Share
External POC / Exploit Code
Leaving vuln.today