EUVD-2026-89682
GHSA-qv2m-v72x-35wc
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessSend HTTP request with malicious User-Agent
-
DeliveryBypass bot-signature substring blacklist
-
ExploitPayload stored as visit statistic
-
ExecutionAdmin opens stats/dashboard page
-
PersistScript executes in admin origin
-
ImpactSteal session or perform admin actions
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Output encoding, context-aware escaping
MITRE ATT&CK
2 techniques across 2 tactics: Initial Access, Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitable against any WordPress site with the Post Views Stats Counter plugin (version 1.1.7 or earlier) installed and active; no authentication, user interaction, or non-default configuration is required to inject, since the payload is delivered via the attacker-controlled User-Agent request header. The plugin's only defense is a substring blacklist for bot signatures ('bot', 'spider', 'crawler'), which the attacker bypasses by crafting a User-Agent that avoids those strings. Execution of the stored script is deferred until a user - typically an administrator viewing the recorded statistics page - loads the page rendering the unescaped value, so realized impact depends on an admin/user visiting the affected view. |
| Impact | The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N, base 7.2) describes a network-reachable, low-complexity, unauthenticated stored XSS with a scope change (S:C reflects script executing in the admin/site origin from attacker-supplied data). The unauthenticated vector is credible because the injection sink is the HTTP User-Agent header, which any visitor controls and the plugin logs without adequate sanitization. No EPSS score, no CISA KEV listing, and no public POC are provided in the input, so exploitation status is 'no public exploit identified at time of analysis' - this is not confirmed active exploitation despite the network/unauth profile. Realistic risk is moderate: the flaw is trivially reachable (the vendor notes the bot-signature blacklist is easily bypassed) but the impact is limited to C:L/I:L (script execution, session/token theft, admin-panel actions) rather than direct server compromise, and the affected plugin has a small footprint. Treat as a genuine but not top-tier priority: patchable web-app XSS in a low-prevalence plugin, higher urgency for any site that actually runs it because triggering requires no authentication. |
| Exploit ScenarioDerived | An unauthenticated attacker sends an ordinary HTTP request to a site running the plugin, setting the User-Agent header to a malicious JavaScript payload crafted to omit blacklisted bot substrings like 'bot', 'spider', or 'crawler'. The plugin stores the raw User-Agent as visit metadata and later renders it unescaped in the WordPress admin statistics view, so the script executes in the administrator's browser session when they open the stats page. No public exploit code is identified, but the technique is straightforward given the described blacklist-only filtering. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 30, 2026
Stored cross-site scripting in the Post Views Stats Counter WordPress plugin (all versions up to and including 1.1.7) allows unauthenticated remote attackers to inject arbitrary JavaScript into a site by placing a payload in the User-Agent request header, which the plugin records without sanitization and later renders without escaping. The plugin's only defense is a substring blacklist for common bot signatures such as 'bot', 'spider' and 'crawler', which is trivially bypassed by omitting those strings, so any site with the plugin active and reachable is exposed with no authentication, user interaction, or non-default configuration needed for the injection step. Execution of the stored script is deferred until a user - typically an administrator loading the plugin's statistics page - views the affected page; no public exploit code has been identified at time of analysis and the issue is not listed in CISA KEV.
RemediationAI
No vendor-released patch identified at time of analysis: the input data names 1.1.7 as the highest affected version but does not identify a fixed release, so verify the plugin's WordPress.org page and the Wordfence advisory at https://www.wordfence.com/threat-intel/vulnerabilities/id/086a8577-eb23-4e05-8ff6-7bbfef62d25c?source=cve for an updated version before assuming a fix is available, and apply it if one appears. If no patched release exists, deactivate and delete the plugin - it is a passive view-counter whose removal is largely cosmetic and eliminates both the storage and the rendering path for the payload. Where removal is not operationally possible, restrict access to the plugin's statistics and admin pages to trusted users, understanding that this only reduces who can trigger execution and does not purge already-stored payloads. A WAF or virtual-patching rule can block or strip script markup, event handlers, and unusual characters from the User-Agent header before it reaches the plugin, at the trade-off that aggressive User-Agent filtering can break legitimate clients with non-standard agent strings, and the plugin's own denylist approach has already been shown to be an unreliable control class. A Content-Security-Policy that disallows inline and untrusted third-party script in the wp-admin origin adds defense in depth against this and similar stored XSS, though it can degrade admin UI functionality if not tuned; note that any mitigation short of removing or patching the plugin leaves attacker-controlled data stored in the database that may execute under other rendering conditions.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
This is CWE-79 (Improper Neutralization of Input During Web Page Generation), specifically the stored/persistent XSS subtype, in a WordPress plugin that counts and displays post views. The plugin captures visitor metadata - including the attacker-controlled User-Agent request header - as part of its view-tracking workflow, stores that value, and later writes it back into HTML on the statistics/admin views without output escaping. The affected code paths are visible in the plugin's Trac source at manage/admin.php lines 447 and 681 and wp_pvscounter.php lines 269 and 411 (version 1.1.7), which correspond to the input-handling and rendering locations. The only input filtering described is a substring blacklist for known bot signatures ('bot', 'spider', 'crawler'), a classic denylist approach that is bypassed simply by crafting a User-Agent string that contains none of those substrings - no encoding tricks are even required. The CPE string cpe:2.3:a:kazukiyanamoto:post_views_stats_counter:*:*:*:*:*:*:*:* maps the flaw to the kazukiyanamoto/post_views_stats_counter WordPress plugin namespace and confirms the applicability is version-wide rather than tied to a particular build. The assessed CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N vector reflects a network-reachable, low-complexity injection requiring no privileges (PR:N) and no victim interaction for the injection itself (UI:N); the scope-change rating (S:C) captures the fact that attacker-supplied data recorded in a visitor-facing context later executes as script in the administrative/site origin, with limited confidentiality and integrity impact and no availability impact as scored.
Know when Post Views Stats Counter gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N
Unauthenticated remote injection via User-Agent (AV:N/AC:L/PR:N/UI:N); stored XSS executing in a different security context gives S:C with limited C/I and no availability impact.
Primary rating from Vendor (Wordfence).
CVSS VectorVendor: Wordfence
DescriptionCVE.org
The Post Views Stats Counter plugin for WordPress is vulnerable to Stored Cross-Site Scripting via User-Agent Header in all versions up to, and including, 1.1.7 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The plugin's only input filter is a substring blacklist for known bot signatures (e.g. 'bot', 'spider', 'crawler'), which can be trivially bypassed by crafting a User-Agent payload that omits those strings.
Executive ViewAI
The Post Views Stats Counter WordPress plugin, deployed on organizational websites to track visitor statistics, contains a high-severity stored cross-site scripting flaw (CVE-2026-97347) affecting all versions up to 1.1.7. An attacker can inject malicious scripts that execute when an administrator views the plugin's statistics page, potentially leading to unauthorized access, data theft, or site defacement. Given that exploitation requires no special conditions, leadership should treat this as an urgent risk to website integrity and user trust.
No vendor-released patch identified at time of analysis. Interim mitigations include: disabling or removing the plugin; deploying a web application firewall (WAF) to block malicious User-Agent payloads; restricting access to the plugin's statistics page; and applying custom sanitization to the User-Agent header before storage and rendering.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Cross-Site Scripting occurs when an application accepts untrusted data and sends it to a web browser without proper validation or encoding.
Exploit-DB