EUVD-2026-33250
GHSA-fm82-44w2-4gmf
Severity by source
AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
Lifecycle Timeline
2DescriptionCVE.org
The StatCounter - Free Real Time Visitor Stats plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 2.1.1 This is due to insufficient output escaping on the post author's nickname in the statcounter_addToTags() function. The function is hooked to wp_head and fires on every single post page. It retrieves the post author's nickname via the_author_meta() and echoes it directly into a JavaScript double-quoted string context inside a <script> block without applying esc_js() or any equivalent JavaScript-context escaping. This makes it possible for authenticated attackers with Author-level access and above to inject arbitrary web scripts into pages that will execute whenever any user (including unauthenticated visitors) accesses a post authored by the attacker.
AnalysisAI
Stored cross-site scripting in the StatCounter - Free Real Time Visitor Stats WordPress plugin (versions up to and including 2.1.1) allows authenticated users with Author-level access or higher to inject arbitrary JavaScript into post pages by setting a crafted WordPress profile nickname. The unescaped nickname is embedded directly into a JavaScript string context within a <script> block rendered on every post page via the wp_head hook, causing the payload to execute in the browser of any visitor - including unauthenticated users - who loads a post authored by the attacker. No public exploit has been identified at time of analysis, but the low attack complexity (AC:L) and broad exposure surface (every post page on affected sites) make this a practical risk wherever sites permit untrusted Author-level accounts.
Technical ContextAI
The vulnerability resides in the statcounter_addToTags() function within the StatCounter - Free Real Time Visitor Stats WordPress plugin (CPE: cpe:2.3:a:statcounter:statcounter_-_free_real_time_visitor_stats:*:*:*:*:*:*:*:*). This function is registered as a callback to the wp_head action hook, meaning it executes in the HTML <head> of every single post page on the WordPress site. The function retrieves the post author's nickname using the_author_meta() - a standard WordPress function that reads user metadata - and then echoes the value directly into a JavaScript double-quoted string literal inside an inline <script> block without applying WordPress's esc_js() function or any equivalent JavaScript-context escaping. CWE-79 (Improper Neutralization of Input During Web Page Generation / XSS) precisely describes this root cause: user-controlled input is output into an executable JavaScript context without sanitization. An attacker who controls their WordPress nickname can terminate the surrounding JS string with a double-quote, inject arbitrary script commands, and comment out the remainder of the line, achieving full stored XSS execution. The source code evidence is directly linked in the WordPress plugin repository at lines 274 and 266 of StatCounter-Wordpress-Plugin.php in the 2.1.1 tag.
RemediationAI
Update the StatCounter - Free Real Time Visitor Stats plugin to version 2.1.2, which is indicated by a WordPress plugin repository changeset diffing the 2.1.1 tag against the 2.1.2 tag (https://plugins.trac.wordpress.org/changeset?old_path=%2Fofficial-statcounter-plugin-for-wordpress/tags/2.1.1&new_path=%2Fofficial-statcounter-plugin-for-wordpress/tags/2.1.2). The expected fix applies esc_js() or equivalent JavaScript-context escaping to the author nickname before it is echoed into the inline script block. Note that version 2.1.2 as a released stable plugin update is inferred from the repository changeset and has not been independently verified as a published WordPress.org release - confirm availability in the WordPress plugin directory before deploying. If an immediate update is not possible, the most actionable compensating control is to audit and restrict who holds Author-level access or higher on the affected site, since exploitation requires an authenticated Author account. Alternatively, deactivating the StatCounter plugin entirely eliminates the attack surface without affecting core site functionality, as the plugin provides analytics tracking only. Do not rely on input filtering at the nickname field alone, as the root cause is output-side escaping failure in the plugin's rendering function.
The isMail transport in PHPMailer before 5.2.20 might allow remote attackers to pass extra parameters to the mail comman
The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
The Hash Form - Drag & Drop Form Builder plugin for WordPress is vulnerable to arbitrary file uploads due to missing fil
The GiveWP - Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to PHP Object Injection in all
The Simple File List plugin for WordPress through version 4.2.2 contains an unauthenticated remote code execution vulner
The AI Engine WordPress plugin through version 3.1.3 exposes Bearer Token values through the /mcp/v1/ REST API endpoint
The Ninja Forms plugin before 2.9.42.1 for WordPress allows remote attackers to conduct PHP object injection attacks via
The Business Directory Plugin - Easy Listing Directories for WordPress plugin for WordPress is vulnerable to time-based
SQL injection in the NotificationX WordPress plugin (versions up to and including 2.8.2) allows unauthenticated remote a
The POST SMTP Mailer - Email log, Delivery Failure Notifications and Best Mail SMTP for WordPress plugin for WordPress i
The MasterStudy LMS WordPress Plugin - for Online Courses and Education plugin for WordPress is vulnerable to union base
The Country State City Dropdown CF7 plugin for WordPress is vulnerable to SQL Injection via the ‘cnt’ and 'sid' paramete
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today