CVE-2026-6275: StatCounter WordPress Plugin XSS Vulnerability

CVE-2026-6275 Overview

CVE-2026-6275 is a Stored Cross-Site Scripting (XSS) vulnerability [CWE-79] in the StatCounter – Free Real Time Visitor Stats plugin for WordPress, affecting all versions up to and including 2.1.1. The flaw resides in the statcounter_addToTags() function, which is hooked to wp_head and executes on every single post page. The function retrieves the post author's nickname through the_author_meta() and echoes it directly into a JavaScript double-quoted string inside a <script> block without applying esc_js(). Authenticated attackers with Author-level access or higher can inject arbitrary JavaScript that executes for any visitor, including unauthenticated users, who views a post they authored.

Critical Impact
Authenticated Author-level users can inject persistent JavaScript that executes in every visitor's browser on posts they authored, enabling session theft, credential harvesting, and administrative account compromise.

Affected Products

StatCounter – Free Real Time Visitor Stats plugin for WordPress versions up to and including 2.1.1
Vulnerable function: statcounter_addToTags() in StatCounter-Wordpress-Plugin.php
Fixed in version 2.1.2

Discovery Timeline

2026-05-29 - CVE-2026-6275 published to NVD
2026-05-29 - Last updated in NVD database

Technical Details for CVE-2026-6275

Vulnerability Analysis

The vulnerability stems from improper output encoding when the plugin embeds user-controlled data into a JavaScript context. The statcounter_addToTags() function is registered as a callback on the wp_head action, so it runs during rendering of every single post page on the affected site. Inside this function, the plugin calls the_author_meta() to retrieve the nickname of the post author and concatenates that value directly into a JavaScript string literal inside an inline <script> tag.

Because the nickname is treated as trusted text rather than untrusted input, the plugin omits any JavaScript-context escaping. WordPress provides esc_js() specifically for this scenario, but it is not applied. An Author-level user can set their own profile nickname to a payload that breaks out of the double-quoted string and introduces arbitrary JavaScript statements.

The resulting script is stored persistently in the WordPress usermeta table and is rendered on every front-end view of any post authored by that user. This makes the issue a stored XSS rather than a reflected one, broadening impact to unauthenticated visitors.

Root Cause

The root cause is missing output escaping in a JavaScript context. WordPress requires that any dynamic data inserted between <script> tags be filtered with esc_js() to neutralize quotes, backslashes, and line terminators. The plugin echoes the_author_meta('nickname') directly into a double-quoted JavaScript string, allowing an attacker-controlled nickname containing " or </script> sequences to terminate the literal and inject executable code.

Attack Vector

An attacker who already holds an Author or higher role updates their user profile nickname to a malicious payload designed to break out of the JavaScript string and run arbitrary code. The attacker then publishes a post. When any visitor loads that post, the unescaped nickname is rendered inside the inline StatCounter script and executes in the visitor's browser session. Typical post-exploitation includes stealing administrator session cookies, performing CSRF-backed plugin or theme installation, or pivoting to a full site takeover.

No verified exploit code is publicly available. See the Wordfence Vulnerability Report and the WordPress Plugin Source Code at line 266 for technical details.

Detection Methods for CVE-2026-6275

Indicators of Compromise

Inline <script> blocks within wp_head output containing unexpected characters such as ";, </script>, or onerror= adjacent to the StatCounter project ID.
User profile nickname fields in the wp_usermeta table containing quote characters, angle brackets, or JavaScript keywords like alert, fetch, or document.cookie.
Outbound requests from visitor browsers to attacker-controlled domains shortly after viewing posts authored by lower-privileged accounts.

Detection Strategies

Query the WordPress database for any usermeta entry where meta_key = 'nickname' and the value contains <, >, ", or script substrings.
Crawl single post pages and inspect rendered HTML for inline scripts where author-derived content escapes the expected JavaScript string boundaries.
Review WordPress audit logs for nickname or display name changes by Author-level accounts followed shortly by new post publication.

Monitoring Recommendations

Enable a Web Application Firewall (WAF) ruleset that flags stored XSS payloads in profile update requests to /wp-admin/profile.php.
Monitor for browser-side JavaScript errors or Content Security Policy (CSP) violation reports originating from post pages.
Alert on creation or privilege changes of Author-level accounts on sites that allow open registration.

How to Mitigate CVE-2026-6275

Immediate Actions Required

Update the StatCounter – Free Real Time Visitor Stats plugin to version 2.1.2 or later on all WordPress sites.
Audit all existing user accounts at the Author role or above and sanitize any nickname or display name values containing HTML or JavaScript syntax.
Rotate administrator session cookies and credentials if suspicious nickname values or unexpected inline scripts are discovered.

Patch Information

The vendor addressed the issue in version 2.1.2 of the plugin. The fix introduces JavaScript-context escaping on the author nickname before it is echoed into the inline script. Review the WordPress Plugin Change Log 2.1.1 to 2.1.2 for the exact code changes.

Workarounds

Deactivate the StatCounter plugin until the update to 2.1.2 can be applied.
Restrict the ability to create or elevate accounts to the Author role on untrusted multi-author sites.
Deploy a strict Content Security Policy (CSP) that disallows inline script execution to limit the impact of stored XSS payloads.

bash

# Update the StatCounter plugin via WP-CLI
wp plugin update official-statcounter-plugin-for-wordpress --version=2.1.2

# Verify installed version
wp plugin get official-statcounter-plugin-for-wordpress --field=version

# Audit nickname values for suspicious content
wp db query "SELECT user_id, meta_value FROM wp_usermeta WHERE meta_key='nickname' AND (meta_value LIKE '%<%' OR meta_value LIKE '%\"%' OR meta_value LIKE '%script%');"