What’s Vulnerable › Vulnerabilities

CVE-2021-25086: Advanced Page Visit Counter < 6.1.2 - Unauthenticated Stored Cross-Site Scripting

• Severity: medium (CVSS 6.1 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 1.3% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2022-05-02 · updated 2026-06-17
• Weakness: CWE-79

Description

The Advanced Page Visit Counter WordPress plugin before 6.1.2 does not sanitise and escape some input before outputting it in an admin dashboard page, allowing unauthenticated attackers to perform Cross-Site Scripting attacks against admins viewing it

Affected products

• Advanced Page Visit Counter – Advanced WordPress Visit Counter: before 6.1.2 — fixed in 6.1.2

How to fix

Upgrade to a fixed version: Advanced Page Visit Counter – Advanced WordPress Visit Counter 6.1.2. Check the vendor advisory for mitigations.

References

• https://wpscan.com/vulnerability/2cf9e517-d882-4af2-bd12-e700b75e7a11
• https://wpscan.com/vulnerability/2cf9e517-d882-4af2-bd12-e700b75e7a11

Get alerted when CVE-2021-25086 or the next vulnerability affects your stack