Stored Cross-Site Scripting in Salavat Counter Plugin for WordPress

CVE-2026-1047

What is CVE-2026-1047?

The Salavat Counter Plugin for WordPress has a vulnerability that allows stored cross-site scripting (XSS) through improper handling of the 'image_url' parameter. Versions up to and including 0.9.5 lack adequate input sanitization and output escaping. This flaw enables authenticated users, with administrator-level access, to inject malicious scripts into web pages. Once injected, these scripts can execute whenever other users visit the compromised pages, posing a significant security risk to sites utilizing this plugin.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References