Advanced Page Visit Counter < 6.1.2 - Unauthenticated Stored Cross-Site Scripting
Priority LOW 30CWE-79Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- Required
- Attack complexity
- Low
- Impact type
- Cross-site scripting
- Confidentiality · integrity · availability
- Low · Low · None
- Fix status
- Fixed
Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-79.
Summary
The Advanced Page Visit Counter WordPress plugin before 6.1.2 does not sanitise and escape some input before outputting it in an admin dashboard page, allowing unauthenticated attackers to perform Cross-Site Scripting attacks against admins viewing it
Why it matters now
EPSS 0.01322 71st percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Fixed Advanced Page Visit Counter – Advanced WordPress Visit Counter (Unknown): 6.1.2
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Unknown | Advanced Page Visit Counter – Advanced WordPress Visit Counter | 6.1.2 to before 6.1.2 | 6.1.2 | Patch available | CNA |
- Advanced Page Visit Counter – Advanced WordPress Visit Counter VendorUnknown Affected 6.1.2 to before 6.1.2 Fixed in 6.1.2 Patch available CNA
CPE configurations NVD · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:advanced_page_visit_counter_project:advanced_page_visit_counter:*:*:*:*:*:wordpress:*:* | before 6.1.2 | Vulnerable | Advanced Page Visit Counter Project |
- cpe:2.3:a:advanced_page_visit_counter_project:advanced_page_visit_counter:*:*:*:*:*:wordpress:*:* Versions before 6.1.2 Vulnerable ·Advanced Page Visit Counter Project
Remediation
- Fix · CNA Advanced Page Visit Counter – Advanced WordPress Visit Counter (Unknown) Fixed in 6.1.2
Timeline
- 2026-10-02 Threatist record created from CVE-2021-25086
- 2026-10-03 Alias added: GHSA-3hhv-jmm7-4v3q
References
More Advanced Page Visit Counter Project Advanced Page Visit Counter vulnerabilities
- TI-2021-07236 Advanced Page Visit Counter < 6.1.6 - Subscriber+ Blind SQL injection CVSS 3.1HIGH 8.8
Sources
- CVE-2021-25086 · CVE Program
- CVE-2021-25086 · NVD
- FIRST EPSS
- GHSA-3hhv-jmm7-4v3q · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences