Stored Cross-Site Scripting Vulnerability in Post Views Stats Counter Plugin by WordPress

CVE-2026-97347

What is CVE-2026-97347?

The Post Views Stats Counter plugin for WordPress suffers from a Stored Cross-Site Scripting vulnerability due to inadequate input sanitization and output escaping. This vulnerability allows unauthenticated attackers to inject arbitrary web scripts into pages, causing these scripts to execute when users access the compromised pages. The plugin's filtering mechanism employs a simplistic substring blacklist targeting known bot signatures, which can easily be circumvented by using custom User-Agent headers that do not include these strings. Users are advised to update to secure versions or apply patches to mitigate the risk associated with this vulnerability.

References