Skip to content
OpenAdvisories

Vendor

StatCounter

3 known vulnerabilities.

Products

StatCounter – Free Real Time Visitor Stats 2 StatCounter 1
All Critical High Medium Low Exploited only Public exploit

3 results · Clear filters · Feed

  • Medium 6.5
    CVE-2026-57629

    WordPress StatCounter plugin <= 2.1.1 - Cross Site Scripting (XSS) vulnerability

    Contributor Cross Site Scripting (XSS) in StatCounter <= 2.1.1 versions.

    StatCounter StatCounter
  • Medium 6.4
    CVE-2026-6275

    StatCounter <= 2.1.1 - Authenticated (Author+) Stored Cross-Site Scripting via Author Nickname

    The StatCounter – Free Real Time Visitor Stats plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 2.1.1 This is due to insufficient output escaping on the post author's nickname in the statcounter_addToTags() f…

    StatCounter StatCounter – Free Real Time Visitor Stats Web / CMS
  • Medium 6.4
    CVE-2025-13048

    Official StatCounter Plugin <= 2.1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Nickname

    The StatCounter – Free Real Time Visitor Stats plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the user's Nickname in all versions up to, and including, 2.1.0 due to insufficient input sanitization and output escaping. This makes it poss…

    StatCounter StatCounter – Free Real Time Visitor Stats Web / CMS