CVE-2025-9116
MEDIUMCVSS Vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:L
Lifecycle Timeline
2Description
The WPS Visitor Counter WordPress plugin through 1.4.8 does not escape the $_SERVER['REQUEST_URI'] parameter before outputting it back in an attribute, which could lead to Reflected Cross-Site Scripting in old web browsers.
Analysis
Reflected cross-site scripting (XSS) in WPS Visitor Counter WordPress plugin through version 1.4.8 allows remote attackers to inject malicious scripts via the REQUEST_URI parameter, which is output without sanitization in HTML attributes. The vulnerability has a CVSS score of 5.8 and requires user interaction (clicking a crafted link), with exploitation limited primarily to older web browsers due to modern XSS protections. No public exploit code or active exploitation has been identified at the time of analysis.
Technical Context
The vulnerability stems from improper input validation and output encoding in the WPS Visitor Counter plugin, specifically in how it processes the $_SERVER['REQUEST_URI'] superglobal variable. REQUEST_URI contains the raw URI requested by the client and, when reflected back into HTML attributes without proper escaping, allows attackers to break out of the attribute context and inject JavaScript. The vulnerability is classified as Reflected XSS (CWE category) because the malicious payload must be delivered via a specially crafted URL. Modern web browsers implement Content Security Policy (CSP) and other XSS filters that mitigate such attacks, which is why the vulnerability note specifically mentions 'old web browsers' as the primary attack surface. This is a server-side rendering issue where the WordPress plugin fails to use functions like esc_attr() or esc_url() before output.
Affected Products
WPS Visitor Counter WordPress plugin versions through 1.4.8 are affected. The plugin is distributed via the WordPress.org plugin repository. Affected installations include any WordPress deployment running this plugin at version 1.4.8 or earlier. The exact earlier vulnerable versions have not been independently confirmed from available data, but the advisory indicates the vulnerability exists through 1.4.8.
Remediation
Update the WPS Visitor Counter plugin to a version newer than 1.4.8 (exact patched version not specified in available advisory data, so refer to the official WordPress.org plugin page or WPScan vulnerability record for the latest available release). Site administrators should navigate to WordPress Dashboard > Plugins, locate WPS Visitor Counter, and click 'Update' if a newer version is available. As an interim workaround if immediate patching is not possible, disable the plugin or restrict access to the WordPress site through a Web Application Firewall (WAF) rule that sanitizes REQUEST_URI parameters. For additional details, refer to the WPScan vulnerability advisory at https://wpscan.com/vulnerability/fe2eb926-96e8-419e-bf41-5531546e6590/.
Priority Score
Share
External POC / Exploit Code
Leaving vuln.today