Security Alert Summary
The StatCounter – Free Real Time Visitor Stats plugin for WordPress contains a stored cross-site scripting (XSS) vulnerability in versions up to and including 2.1.1. The plugin outputs a post author\’s nickname into a JavaScript string without proper JavaScript-context escaping, allowing authenticated users with Author-level access and above to inject scripts that execute when a post by that author is viewed.
CVE Details
- CVE ID: CVE-2026-6275
- Affected component: StatCounter – Free Real Time Visitor Stats plugin for WordPress
- Affected versions: Versions up to and including 2.1.1
- Published: May 29, 2026 07:16 AM UTC
- Last modified: May 29, 2026 01:09 PM UTC
- CVSS v3.1: Base Score 6.4, Severity MEDIUM, Vector String: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
- Authentication / privileges / user interaction: Description states authenticated attackers with Author-level access and above. CVSS: Privileges Required = LOW, User Interaction = NONE.
- Primary impact: Confidentiality: LOW; Integrity: LOW; Availability: NONE
- Weakness (CWE): CWE-79 (Cross-site Scripting)
Technical Details
This is a stored cross-site scripting (XSS) issue caused by insufficient output escaping of the post author\’s nickname. The plugin\’s statcounter_addToTags() function is hooked to wp_head and runs on every single post page. It retrieves the author nickname using the_author_meta() and echoes that value directly into a JavaScript double-quoted string inside a <script> block without using esc_js() or equivalent JavaScript-context escaping.
Because the author nickname is written into a script string without proper escaping, an authenticated user with Author-level privileges or higher can store a payload that will be output to visitors viewing that post. The stored script will run in the context of the page whenever the post is viewed, allowing arbitrary web scripts to execute in victims\’ browsers.
How This Could Impact Your Website
On a multi-author site the site owner or administrators may assign Author or higher roles to internal staff, contractors, or external contributors. An attacker who has Author-level access could add or modify content so their malicious payload is included in their nickname. When site editors, authenticated users, or public visitors view the affected post, the injected script will run in their browsers.
Practical consequences include disclosure of data accessible in the browser (for example, session cookies or visible page content), which can increase the risk of targeted phishing or social engineering against staff and users, and potential unauthorized actions executed in the context of a victim\’s session. It may also increase the chance of exposure of internal user email addresses or other information present in the page DOM.
If you\’re unsure whether your site is affected or how to assess your current user roles and plugins, it may be worth having a professional review.
Recommended Actions
- Update the affected plugin as soon as a patched version is available.
- Review and reduce unnecessary user roles, especially Author-level and higher, and limit who can publish or edit posts.
- Enforce strong passwords and two-factor authentication for editors and administrators.
- Remove unused or unmaintained plugins from your site.
- Monitor site activity and logs for unusual behavior, such as unexpected script injections or changes to author metadata.
If you\’d like help reviewing your plugins, user roles, or overall WordPress security posture, our team at Freshy is happy to help.
References
- https://plugins.trac.wordpress.org/browser/official-statcounter-plugin-for-wordpress/tags/2.1.1/StatCounter-Wordpress-Plugin.php#L266
- https://plugins.trac.wordpress.org/browser/official-statcounter-plugin-for-wordpress/tags/2.1.1/StatCounter-Wordpress-Plugin.php#L274
- https://plugins.trac.wordpress.org/browser/official-statcounter-plugin-for-wordpress/trunk/StatCounter-Wordpress-Plugin.php#L266
- https://plugins.trac.wordpress.org/browser/official-statcounter-plugin-for-wordpress/trunk/StatCounter-Wordpress-Plugin.php#L274
- https://plugins.trac.wordpress.org/changeset?old_path=%2Fofficial-statcounter-plugin-for-wordpress/tags/2.1.1&new_path=%2Fofficial-statcounter-plugin-for-wordpress/tags/2.1.2
- https://www.wordfence.com/threat-intel/vulnerabilities/id/30e0bf40-7f7b-43e6-8439-6dc00a889344?source=cve
