https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Wed, 07 Oct 2026 08:23:29 +0000 https://cve.radiocsirt.org/vuln/cve-2026-6275 <p><strong>Affected:</strong> StatCounter – Free Real Time Visitor Stats</p> <p>The StatCounter – Free Real Time Visitor Stats plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 2.1.1 This is due to insufficient output escaping on the post author&#39;s nickname in the statcounter_addToTags() function. The function is hooked to wp_head and fires on every single post page. It retrieves the post author&#39;s nickname via the_author_meta() and echoes it directly into a JavaScript double-quoted string context inside a &lt;script&gt; block without applying esc_js() or any equivalent JavaScript-context escaping. This makes it possible for authenticated attackers with Author-level access and above to inject arbitrary web scripts into pages that will execute whenever any user (including unauthenticated visitors) accesses a post authored by the attacker.</p> <p><strong>Affected:</strong> StatCounter – Free Real Time Visitor Stats</p> <p>The StatCounter – Free Real Time Visitor Stats plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 2.1.1 This is due to insufficient output escaping on the post author&#39;s nickname in the statcounter_addToTags() function. The function is hooked to wp_head and fires on every single post page. It retrieves the post author&#39;s nickname via the_author_meta() and echoes it directly into a JavaScript double-quoted string context inside a &lt;script&gt; block without applying esc_js() or any equivalent JavaScript-context escaping. This makes it possible for authenticated attackers with Author-level access and above to inject arbitrary web scripts into pages that will execute whenever any user (including unauthenticated visitors) accesses a post authored by the attacker.</p> https://cve.radiocsirt.org/vuln/cve-2026-6275