Description
The StatCounter – Free Real Time Visitor Stats plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 2.1.1 This is due to insufficient output escaping on the post author's nickname in the statcounter_addToTags() function. The function is hooked to wp_head and fires on every single post page. It retrieves the post author's nickname via the_author_meta() and echoes it directly into a JavaScript double-quoted string context inside a <script> block without applying esc_js() or any equivalent JavaScript-context escaping. This makes it possible for authenticated attackers with Author-level access and above to inject arbitrary web scripts into pages that will execute whenever any user (including unauthenticated visitors) accesses a post authored by the attacker.
Published: 2026-05-29
Score: 6.4 Medium
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

The vulnerability resides in the StatCounter plugin’s handling of the post author's nickname within a JavaScript context. Because the nickname is inserted directly into a <script> block without proper escaping, an attacker can place malicious script code. This results in stored XSS that executes in the browsers of all users who visit the author’s posts.

Affected Systems

WordPress sites running the StatCounter – Free Real Time Visitor Stats plugin version 2.1.1 or earlier. No other versions are currently listed as affected.

Risk and Exploitability

The CVSS score of 6.4 indicates a medium‑severity flaw; the EPSS score is not available, and the vulnerability is not in CISA’s KEV catalog. The likely attack vector is an authenticated attacker with Author‑level access or higher, who supplies a crafted nickname. Once the nickname is stored, the payload executes automatically for all visitors to the author’s posts.

Generated by OpenCVE AI on May 29, 2026 at 07:51 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade the StatCounter plugin to version 2.1.2 or later, which removes the vulnerability.
  • If immediate upgrade is not possible, revoke or restrict author‑level permissions to prevent malicious nickname creation until a patch can be applied.
  • Sanitize or correct any existing author nicknames that contain script code, or change them to safe content to eliminate stored payloads.

Generated by OpenCVE AI on May 29, 2026 at 07:51 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Fri, 29 May 2026 10:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Fri, 29 May 2026 07:45:00 +0000

Type Values Removed Values Added
First Time appeared Statcounter
Statcounter statcounter – Free Real Time Visitor Stats
Wordpress
Wordpress wordpress
Vendors & Products Statcounter
Statcounter statcounter – Free Real Time Visitor Stats
Wordpress
Wordpress wordpress

Fri, 29 May 2026 06:30:00 +0000

Type Values Removed Values Added
Description The StatCounter – Free Real Time Visitor Stats plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 2.1.1 This is due to insufficient output escaping on the post author's nickname in the statcounter_addToTags() function. The function is hooked to wp_head and fires on every single post page. It retrieves the post author's nickname via the_author_meta() and echoes it directly into a JavaScript double-quoted string context inside a <script> block without applying esc_js() or any equivalent JavaScript-context escaping. This makes it possible for authenticated attackers with Author-level access and above to inject arbitrary web scripts into pages that will execute whenever any user (including unauthenticated visitors) accesses a post authored by the attacker.
Title StatCounter <= 2.1.1 - Authenticated (Author+) Stored Cross-Site Scripting via Author Nickname
Weaknesses CWE-79
References
Metrics cvssV3_1

{'score': 6.4, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N'}

Subscriptions

Statcounter Statcounter – Free Real Time Visitor Stats
Wordpress Wordpress
cve-icon MITRE

Status: PUBLISHED

Assigner: Wordfence

Published:

Updated: 2026-05-29T10:07:11.779Z

Reserved: 2026-04-14T13:44:26.816Z

Link: CVE-2026-6275

cve-icon Vulnrichment

Updated: 2026-05-29T10:07:06.046Z

cve-icon NVD

Status : Deferred

Published: 2026-05-29T07:16:14.197

Modified: 2026-05-29T13:09:05.450

Link: CVE-2026-6275

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-05-29T08:00:06Z

Weaknesses