PT-2025-51089

CVE-2025-9116

·

Published

2025-11-21

·

Updated

2025-12-13

Description by

CVSS 3.1
5.8
Medium
MetricsAV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:L
Name of the Vulnerable Software and Affected Versions WPS Visitor Counter Plugin versions through 1.4.8
Description The plugin does not properly handle the $ SERVER['REQUEST URI'] parameter before displaying it, potentially allowing for Reflected Cross-Site Scripting (XSS) in older web browsers. The vulnerable parameter is used in an attribute without proper escaping.
Recommendations Update WPS Visitor Counter Plugin to a version later than 1.4.8.
Exploitability
Exploit
Fix
Researchers
Vendors
Affected products
Related identifiers
CVE-2025-9116
Found an issue in the description? Have something to add? Feel free to write us 👾
dbugs@ptsecurity.com