CVE-2026-81795

WordPress Page Visits Counter – Lite plugin <= 1.2.3 - Cross Site Scripting (XSS) vulnerability

Published Sep 10, 2026 CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed

Description

Unauthenticated Cross Site Scripting (XSS) in Page Visits Counter – Lite <= 1.2.3 versions.

Analysis

Technical impact

Unauthenticated Cross Site Scripting (XSS) exists in Page Visits Counter – Lite versions up to 1.2.3. The flaw allows injection of arbitrary JavaScript when a page displays the visit counter. The injected script runs in the context of the site, potentially affecting site functionality.

Affected Systems

The vulnerability affects WordPress installations running the Denis Botić:Page Visits Counter – Lite plugin version 1.2.3 or earlier. The plugin’s counter displays visitor statistics on site pages.

Risk and Exploitability

Attack execution does not require authentication and relies on a user accessing a page where the counter is rendered; therefore anyone who can view the site could potentially trigger the payload. The CVSS score of 7.1 indicates high severity. The EPSS score is not available, and the vulnerability is not listed in CISA's KEV catalog.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Denis Botić

Page Visits Counter – Lite

unaffected

Version	Status	Constraints
`n/a`	affected	≤ 1.2.3

No data.

Vendor Product Versions

Denis Botić

Page Visits Counter – Lite

Version	Status	Scheme	Platform
`[0,1.2.3]`	affected	semver	—

Wordpress

Version	Status	Scheme	Platform
`—`	unaffected	—	—

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Upgrade Page Visits Counter – Lite to the latest version that resolves the XSS flaw.
If an upgrade is not immediately possible, deactivate or uninstall the plugin to eliminate the exposed input vector.
Configure a strict Content Security Policy (CSP) that disallows inline scripts or restricts script execution to trusted origins, reducing the impact of any residual XSS injection.

Generated by OpenCVE AI on September 10, 2026 at 16:09 UTC.

Tracking

Advisories

No advisories available

Metrics

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Changed

Confidentiality Impact Low

Integrity Impact Low

Availability Impact Low

User Interaction Required

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.251% probability within 30 days)

Exploitation none

Automatable no

Technical Impact partial

References

Link	Providers
https://patchstack.com/database/wordpress/plugin/page-visits-counter-lite/vulnerability/wordpress-page-visits-counter-lite-plugin-1-2-3-cross-site-scripting-xss-vulnerability?_s_id=cve

History

Sep 13, 2026 8:30 PM First appearance in the feed. Affected vendors updated View changes

Type	Values Removed	Values Added
First Time appeared		Denis Botić Denis Botić page Visits Counter – Lite Wordpress Wordpress wordpress
Vendors & Products		Denis Botić Denis Botić page Visits Counter – Lite Wordpress Wordpress wordpress

Sep 10, 2026 3:30 PM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Sep 10, 2026 2:45 PM Description updated. Title updated. Weaknesses updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Description		Unauthenticated Cross Site Scripting (XSS) in Page Visits Counter – Lite <= 1.2.3 versions.
Title		WordPress Page Visits Counter – Lite plugin <= 1.2.3 - Cross Site Scripting (XSS) vulnerability
Weaknesses		CWE-79
References		https://patchstack.com/database/wordpress/plugin/page-visits-counter-lite/vulnerability/wordpress-page-visits-counter-lite-plugin-1-2-3-cross-site-scripting-xss-vulnerability?_s_id=cve
Metrics		cvssV3_1 `{'score': 7.1, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L'}`