AJAX Hits Counter + Popular Posts Widget

AJAX Hits Counter + Popular Posts Widget has one disclosed vulnerability in the WordSec catalog, all reported in 2026; it remains unpatched as of September 2026. Their average CVSS score is 4.3, and the most serious one scores 4.3 out of 10.

The most common weakness is Missing Authorization, behind 1 of the records (100%).

The one issue recorded for AJAX Hits Counter + Popular Posts Widget has no published fix yet, which makes virtual patching the only reliable mitigation. The oldest unresolved one dates back to 2026.

All of these findings were reported by Nabil Irawan. AJAX Hits Counter + Popular Posts Widget is installed on roughly 900 WordPress sites, so each unpatched flaw has a wide blast radius. The current release is tested up to WordPress 5.7.17.

Strategic Overview

Avg CVSSMedium
4.3/ 10
Patch Coverage0%
Open

1

Fixed

0

Get automatic notifications for all AJAX Hits Counter + Popular Posts Widget vulnerabilities before they are exploited.

Most severe open issueCVSS 4.3CVE-2026-24587

AJAX Hits Counter + Popular Posts Widget <= 0.10.210305 - Missing Authorization

Read the full analysis

Vulnerability Records

1 records
Plugin Profile
Latestv0.10.210305

AJAX Hits Counter + Popular Posts Widget

kutsy

Author

kutsy

4.9(17)
98/100
Last Updated
2021-03-05 (6y ago)
Active Installs
900+
Downloads
45,070
Requires WP
3.0+
Requires PHP
0+
Tested up to
WP 5.7.17
Created
2012-08-20 (14y ago)

Plugin counts posts views (hits) by using external AJAX based counter script of this plugin, which is best solution for caching whole page or using other cache plugins. Plugin also include widget “Popular Posts” for displaying popular posts (based on hits count) with different visibility settings and using predefined placeholders, such as {post_id}, {post_title}, {post_title_N}, {post_excerpt_N}, {post_author}, {post_author_link}, {permalink}, {post_date}, {thumbnail-[medium|...|64x64]}, {post_categories}, {post_hits} and {post_comments_count}. You can show hits count in Posts/Pages Loop simply adding this line: <?php echo(ajax_hits_counter_get_hits(get_the_ID())); ?> or equivalent <?= ajax_hits_counter_get_hits(get_the_ID()) ?> Or you can use this shortcode: [hits]. Plugin also have JavaScript-callback function (on client) for “success” (ajaxHitsCounterSuccessCallback(xhr)) and for “failed” (ajaxHitsCounterFailedCallback(xhr)) result status of hits incrementation. Features AJAX based counter ignores most bots/crawlers Ability to reset the counter to any number any time Plugin not require using any third party code and/or JavaScript-frameworks Sortable admin column Can be shown anywhere on the site using “Popular Posts Widget”, shortcode [hits], php-code <?= ajax_hits_counter_get_hits(get_the_ID()) ?> Data import from WP-PostViews (“Tools”->”Import”) W3 Cache/WP SuperCache compatible Excluding counts from administrators

Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C