🔐 CVE Alert

CVE-2026-97347

HIGH 7.2

Post Views Stats Counter <= 1.1.7 - Unauthenticated Stored Cross-Site Scripting via User-Agent Header

CVSS Score
7.2
EPSS Score
0.0%
EPSS Percentile
0th

The Post Views Stats Counter plugin for WordPress is vulnerable to Stored Cross-Site Scripting via User-Agent Header in all versions up to, and including, 1.1.7 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The plugin's only input filter is a substring blacklist for known bot signatures (e.g. 'bot', 'spider', 'crawler'), which can be trivially bypassed by crafting a User-Agent payload that omits those strings.

CWE CWE-79
Vendor kazukiyanamoto
Product post views stats counter
Published Sep 30, 2026
Stay Ahead of the Next One

Get instant alerts for kazukiyanamoto post views stats counter

Be the first to know when new high vulnerabilities affecting kazukiyanamoto post views stats counter are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N
Attack Vector
Attack Complexity
Privileges Required
User Interaction
Scope
Confidentiality
Integrity
Availability

Affected Versions

kazukiyanamoto / Post Views Stats Counter
0 ≤ 1.1.7

References

NVD ↗ CVE.org ↗ EPSS Data ↗
wordfence.com: https://www.wordfence.com/threat-intel/vulnerabilities/id/086a8577-eb23-4e05-8ff6-7bbfef62d25c?source=cve plugins.trac.wordpress.org: https://plugins.trac.wordpress.org/browser/post-views-stats-counter/tags/1.1.7/manage/admin.php#L681 plugins.trac.wordpress.org: https://plugins.trac.wordpress.org/browser/post-views-stats-counter/tags/1.1.7/manage/admin.php#L447 plugins.trac.wordpress.org: https://plugins.trac.wordpress.org/browser/post-views-stats-counter/tags/1.1.7/wp_pvscounter.php#L411 plugins.trac.wordpress.org: https://plugins.trac.wordpress.org/browser/post-views-stats-counter/tags/1.1.7/wp_pvscounter.php#L269

Credits

Nawaf Althurwi (JailBr3ak)