Official Statcounter Plugin For Wordpress Vulnerabilities

The StatCounter – Free Real Time Visitor Stats plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 2.1.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbi...

CVSS:

6.4

Affected:

up to 2.1.1

Fixed in:

2.1.2

Disclosed:

Jun 26, 2026

CVE-2026-57629 on NVD →

The StatCounter – Free Real Time Visitor Stats plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 2.1.1 This is due to insufficient output escaping on the post author's nickname in the statcounter_addToTags() function. The function is hooked to wp_head and fires on every...

CVSS:

6.4

Affected:

up to 2.1.1

Fixed in:

2.1.2

Disclosed:

May 28, 2026

CVE-2026-6275 on NVD →

The StatCounter – Free Real Time Visitor Stats plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the user's Nickname in all versions up to, and including, 2.1.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level acce...

CVSS:

6.4

Affected:

up to 2.1.0

Fixed in:

2.1.1

Disclosed:

Feb 18, 2026

CVE-2025-13048 on NVD →

The StatCounter WordPress plugin before 2.0.7 does not sanitise and escape the Project ID and Secure Code settings, which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed

CVSS:

4.8

Affected:

up to 2.0.7

Fixed in:

2.0.7

Disclosed:

Jan 26, 2022

CVE-2021-24920 on NVD →