Post Views Stats Counter
Monthly
Stored cross-site scripting in the Post Views Stats Counter WordPress plugin (all versions up to and including 1.1.7) allows unauthenticated remote attackers to inject arbitrary JavaScript into a site by placing a payload in the User-Agent request header, which the plugin records without sanitization and later renders without escaping. The plugin's only defense is a substring blacklist for common bot signatures such as 'bot', 'spider' and 'crawler', which is trivially bypassed by omitting those strings, so any site with the plugin active and reachable is exposed with no authentication, user interaction, or non-default configuration needed for the injection step. Execution of the stored script is deferred until a user - typically an administrator loading the plugin's statistics page - views the affected page; no public exploit code has been identified at time of analysis and the issue is not listed in CISA KEV.
Stored cross-site scripting in the Post Views Stats Counter WordPress plugin (all versions up to and including 1.1.7) allows unauthenticated remote attackers to inject arbitrary JavaScript into a site by placing a payload in the User-Agent request header, which the plugin records without sanitization and later renders without escaping. The plugin's only defense is a substring blacklist for common bot signatures such as 'bot', 'spider' and 'crawler', which is trivially bypassed by omitting those strings, so any site with the plugin active and reachable is exposed with no authentication, user interaction, or non-default configuration needed for the injection step. Execution of the stored script is deferred until a user - typically an administrator loading the plugin's statistics page - views the affected page; no public exploit code has been identified at time of analysis and the issue is not listed in CISA KEV.