CVE-2026-81795 in Page Visits Counter Plugin
Summary
by MITRE • 09/10/2026
Unauthenticated Cross Site Scripting (XSS) in Page Visits Counter – Lite <= 1.2.3 versions.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 09/10/2026
The vulnerability identified as an unauthenticated cross-site scripting flaw within the Page Visits Counter plugin for WordPress, specifically affecting versions up to and including 1.2.3, represents a significant security risk due to its lack of authentication requirements. This classification indicates that any user interacting with the affected website can exploit this weakness without needing valid credentials or prior login access. The core technical flaw stems from insufficient input validation and sanitization mechanisms within the plugin's codebase when processing data related to page visit counts. When a malicious actor crafts a request containing specially designed script payloads, these inputs are not adequately filtered before being processed by the application logic. Consequently, the injected scripts can be executed in the context of the victim’s browser session whenever their interaction triggers the vulnerable function associated with counting or displaying page visits.
From an operational perspective, this vulnerability allows attackers to execute arbitrary JavaScript code on behalf of unsuspecting users who visit pages where the compromised plugin is active. The impact extends beyond simple defacement; it facilitates a range of malicious activities including session hijacking, credential theft via keylogging scripts, and redirection to phishing sites or malware distribution platforms. Since the attack does not require authentication, the potential blast radius is broad, affecting any visitor regardless of their role or permission level on the site. This aligns with CWE-79, which defines Improper Neutralization of Input During Web Page Generation as Cross-site Scripting (XSS). The ease of exploitation makes this a high-priority issue for administrators to address immediately, particularly given that many WordPress sites rely heavily on such plugins for analytics and user engagement metrics.
The attack vector typically involves the attacker embedding malicious JavaScript code within parameters or fields that are reflected back in the response without proper encoding. This could occur through URL parameters, form inputs, or other data points handled by the Page Visits Counter plugin. Once executed, the script runs with the same privileges as legitimate scripts loaded on the page, potentially accessing cookies, local storage, and DOM elements. Under the MITRE ATT&CK framework for enterprise security, this behavior maps to techniques such as Client-side Scripting (T1059) and specifically Cross-Site Scripting: Stored or Reflected depending on how the payload is delivered and persisted. If the input is stored in a database and later retrieved, it falls under stored XSS; if it is immediately reflected in the response, it is classified as reflected XSS. Both variants pose severe risks to data integrity and confidentiality.
Mitigation strategies must focus on immediate remediation through software updates or manual code intervention. The primary recommendation is to update the Page Visits Counter plugin to a version greater than 1.2.3 where this vulnerability has been patched by the developers. If an updated version is unavailable, administrators should consider disabling or uninstalling the plugin entirely until a fix is released. In cases where custom development is required, input validation must be strictly enforced using allowlists for expected data types and characters. Output encoding should also be implemented to ensure that any user-supplied data rendered in HTML contexts is properly escaped. Additionally, implementing Content Security Policy headers can provide an additional layer of defense by restricting the sources from which scripts are allowed to execute, thereby mitigating the impact even if a script injection attempt succeeds. Regular security audits and vulnerability scanning should be integrated into the maintenance routine to detect similar weaknesses in other plugins or core components before they can be exploited.