Unauthenticated XSS in Page Visits Counter Lite

Executive Summary

CVE-2026-81795 is an Unauthenticated Cross Site Scripting (XSS) vulnerability affecting the WordPress Page Visits Counter – Lite Plugin versions 1.2.3 and below. It allows attackers to inject malicious scripts into a website that execute when visitors access the site, potentially causing redirects or unwanted content display.

Useful 0 Not Useful 0

Detection Guidance

Detecting this XSS vulnerability typically involves checking for the presence of the vulnerable plugin versions (1.2.3 or below) on WordPress sites. Inspect web server logs for unusual script injections or requests targeting the Page Visits Counter Lite plugin. Use tools like WPScan to scan for vulnerable plugins: wpscan --url <target_url> --enumerate vp,vt. Monitor for unauthorized script execution in browser consoles or security plugins.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability could allow attackers to execute malicious scripts on your website when visitors access it. This might lead to actions like redirecting users to harmful sites, stealing cookies or session tokens, or displaying unwanted content. Exploitation requires user interaction, such as clicking a malicious link.

Useful 0 Not Useful 0

Compliance Impact

XSS vulnerabilities can compromise user data integrity and confidentiality, potentially violating GDPR and HIPAA requirements for protecting personal and health information. Unauthorized script execution may lead to data breaches or unauthorized access, triggering compliance violations and legal consequences.

Useful 0 Not Useful 0

Mitigation Strategies

Disable or remove the Page Visits Counter Lite plugin versions 1.2.3 or below immediately. Apply Patchstack's provided mitigation rule to block attacks until an official patch is released. Seek assistance from a hosting provider or developer if needed.

Useful 0 Not Useful 0