Visit Counter Vulnerabilities

[en] The Visit Counter plugin for WordPress is vulnerable to Cross-Site Request Forgery in version 1.0. This is due to missing or incorrect nonce validation on the widgets.php page. This makes it possible for unauthenticated attackers to update settings and inject malicious web scripts via a forged request granted they...

Affected:

up to 1.0

Fix:

No patched version reported

Disclosed:

Nov 4, 2025

CVE-2025-12452 on NVD →

The Visit Counter plugin for WordPress is vulnerable to Cross-Site Request Forgery in version 1.0. This is due to missing or incorrect nonce validation on the widgets.php page. This makes it possible for unauthenticated attackers to update settings and inject malicious web scripts via a forged request granted they can...

CVSS:

6.1

Affected:

1.0 – 1.0

Fix:

No patched version reported

Disclosed:

Nov 3, 2025

CVE-2025-12452 on NVD →

[en] Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in BestiaDurmiente Visit Counter allows Stored XSS. This issue affects Visit Counter: from n/a through 1.0.

Affected:

up to 1.0

Fix:

No patched version reported

Disclosed:

Aug 14, 2025

CVE-2025-49065 on NVD →

The Visit Counter plugin for WordPress is vulnerable to Reflected Cross-Site Scripting in all versions up to, and including, 1.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully...

CVSS:

6.1

Affected:

up to 1.0

Fix:

No patched version reported

Disclosed:

Aug 7, 2025

CVE-2025-49065 on NVD →