Executive brief
The StatCounter plugin for WordPress, which is used to track website visitor statistics, contains a security flaw that allows users with 'Contributor' level access to inject malicious scripts into the site. If a site administrator or visitor views the affected page, these scripts could execute, potentially leading to unauthorized redirects, the display of fraudulent advertisements, or the theft of session information. This vulnerability could be used to compromise the integrity of the website and its users' data.
Technical details
A stored Cross-Site Scripting (XSS) vulnerability exists in the official StatCounter plugin for WordPress (versions 2.1.1 and below). The flaw is rooted in improper neutralization of user-supplied input during web page generation (CWE-79). An attacker with 'Contributor' or higher privileges can inject malicious HTML or JavaScript payloads into the WordPress site. Successful exploitation requires a victim (such as an administrator) to interact with the affected page or perform a specific action, triggering the script execution in their browser context. This can lead to session hijacking, unauthorized administrative actions, or site defacement. The issue is resolved in version 2.1.2.
Affected products
- StatCounter StatCounter <= 2.1.1
Timeline
- 2026-02-16: other: Reported by researcher timomangcut
- 2026-06-26: advisory: Published by Patchstack and NVD
- 2026-06-26: patched: Version 2.1.2 released to address the vulnerability