CVE-2026-97347: Post Views Stats Counter <= 1.1.7 - Unauthenticated Stored Cross-Site Scripting via User-Agent Header
The Post Views Stats Counter plugin for WordPress is vulnerable to Stored Cross-Site Scripting via User-Agent Header in all versions up to, and including, 1.1.7 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The plugin's only input filter is a substring blacklist for known bot signatures (e.g. 'bot', 'spider', 'crawler'), which can be trivially bypassed by crafting a User-Agent payload that omits those strings.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue, and what access do they need?
Any unauthenticated remote attacker can attempt exploitation by sending requests with a crafted User-Agent header. No WordPress account, plugin privilege, or user interaction is required to inject the payload.
Are default bot-filtering protections sufficient to prevent exploitation?
No. The plugin only checks the User-Agent against a substring blacklist for bot-related terms such as "bot," "spider," and "crawler." An attacker can bypass this filter by using a payload that does not contain those strings.
Which deployments should be considered affected?
WordPress sites using Post Views Stats Counter version 1.1.7 or earlier should be considered affected. The vulnerable behavior is the storage and later rendering of unsanitized User-Agent data.
What happens after a malicious User-Agent value is stored?
The injected script can execute in the browser of a user who accesses a page where the stored payload is rendered. This may expose information available to that user and allow actions in their browser context.