AJAX Hits Counter + Popular Posts Widget
AJAX Hits Counter + Popular Posts Widget has one disclosed vulnerability in the WordSec catalog, all reported in 2026; it remains unpatched as of September 2026. Their average CVSS score is 4.3, and the most serious one scores 4.3 out of 10.
The most common weakness is Missing Authorization, behind 1 of the records (100%).
The one issue recorded for AJAX Hits Counter + Popular Posts Widget has no published fix yet, which makes virtual patching the only reliable mitigation. The oldest unresolved one dates back to 2026.
All of these findings were reported by Nabil Irawan. AJAX Hits Counter + Popular Posts Widget is installed on roughly 900 WordPress sites, so each unpatched flaw has a wide blast radius. The current release is tested up to WordPress 5.7.17.
CVE-2026-24587AJAX Hits Counter + Popular Posts Widget <= 0.10.210305 - Missing Authorization
Read the full analysisVulnerability Records
AJAX Hits Counter + Popular Posts Widget
Author
kutsy
Plugin counts posts views (hits) by using external AJAX based counter script of this plugin, which is best solution for caching whole page or using other cache plugins. Plugin also include widget “Popular Posts” for displaying popular posts (based on hits count) with different visibility settings and using predefined placeholders, such as {post_id}, {post_title}, {post_title_N}, {post_excerpt_N}, {post_author}, {post_author_link}, {permalink}, {post_date}, {thumbnail-[medium|...|64x64]}, {post_categories}, {post_hits} and {post_comments_count}. You can show hits count in Posts/Pages Loop simply adding this line: <?php echo(ajax_hits_counter_get_hits(get_the_ID())); ?> or equivalent <?= ajax_hits_counter_get_hits(get_the_ID()) ?> Or you can use this shortcode: [hits]. Plugin also have JavaScript-callback function (on client) for “success” (ajaxHitsCounterSuccessCallback(xhr)) and for “failed” (ajaxHitsCounterFailedCallback(xhr)) result status of hits incrementation. Features AJAX based counter ignores most bots/crawlers Ability to reset the counter to any number any time Plugin not require using any third party code and/or JavaScript-frameworks Sortable admin column Can be shown anywhere on the site using “Popular Posts Widget”, shortcode [hits], php-code <?= ajax_hits_counter_get_hits(get_the_ID()) ?> Data import from WP-PostViews (“Tools”->”Import”) W3 Cache/WP SuperCache compatible Excluding counts from administrators
Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C