CVE-2025-13048

Name of the Vulnerable Software and Affected Versions StatCounter – Free Real Time Visitor Stats plugin for WordPress versions prior to 2.1.1

Description The StatCounter plugin for WordPress is susceptible to Stored Cross-Site Scripting due to inadequate input sanitization and output escaping. This allows authenticated attackers with Contributor-level access or higher to inject malicious web scripts into pages. These scripts will then execute whenever a user accesses the compromised page. The vulnerability is related to the Nickname field.

Recommendations Update the StatCounter – Free Real Time Visitor Stats plugin for WordPress to version 2.1.1 or later.