Page Visits Counter 8211 Lite
Monthly
Unauthenticated cross-site scripting in the Page Visits Counter - Lite WordPress plugin (versions ≤ 1.2.3) allows a remote, unauthenticated attacker to inject malicious JavaScript that executes in the browser context of a visiting user. Because CVSS marks scope as Changed (S:C), the injected script can escape the plugin's own context and affect the broader WordPress page environment, enabling session hijacking, credential theft, or malicious redirects. No public exploit or CISA KEV listing has been identified at time of analysis; the issue was disclosed by Patchstack.
Unauthenticated cross-site scripting in the Page Visits Counter - Lite WordPress plugin (versions ≤ 1.2.3) allows a remote, unauthenticated attacker to inject malicious JavaScript that executes in the browser context of a visiting user. Because CVSS marks scope as Changed (S:C), the injected script can escape the plugin's own context and affect the broader WordPress page environment, enabling session hijacking, credential theft, or malicious redirects. No public exploit or CISA KEV listing has been identified at time of analysis; the issue was disclosed by Patchstack.