Cross Site Scripting Vulnerability in Page Visits Counter Lite by WordPress
CVE-2026-81795

7.1HIGH

Key Information:

Vendor

WordPress
Status
Page Visits Counter – Lite
Vendor
CVE Published:
10 September 2026

What is CVE-2026-81795?

A vulnerability has been identified in the Page Visits Counter Lite plugin for WordPress that allows unauthenticated users to execute arbitrary scripts via unsanitized input. This results in a Cross Site Scripting (XSS) attack, which could lead to the injection of malicious code into web pages viewed by other users. This flaw is present in versions 1.2.3 and earlier, posing a significant risk to websites utilizing this plugin. Users are encouraged to apply patches or updates to mitigate exposure to this vulnerability.

Affected Version(s)

Page Visits Counter &#8211; Lite <= 1.2.3

References

https://patchstack.com/database/wordpress/plugin/page-vis...
vdb-entry

CVSS V3.1

Score:
7.1
Severity:
HIGH
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Nguyen Ba Khanh - HPT Vietnam Corporation | Patchstack Bug Bounty Program
.