Most And Least Read Posts Widget
Most And Least Read Posts Widget has 3 disclosed vulnerabilities in the WordSec catalog, reported between 2023 and 2025; all 3 are fixed as of September 2026. Their average CVSS score is 6.5, and the most serious one scores 8.8 out of 10. Severity breakdown: 0 critical and 1 high.
The most common weakness is Cross-Site Request Forgery (CSRF), behind 1 of the records (33%). Other recurring categories include Cross-Site Scripting, SQL Injection.
Every one of the 3 issues recorded for Most And Least Read Posts Widget has a vendor fix available, so running the current release closes all known holes.
2 independent researchers contributed these findings, one record each. Most And Least Read Posts Widget is installed on roughly 900 WordPress sites, so each unpatched flaw has a wide blast radius. The current release is tested up to WordPress 7.1.
CVE-2023-52133Most And Least Read Posts Widget <=2.5.16 - Authenticated(Contributor+) SQL Injection via Widget settings
Read the full analysisVulnerability Records

Most And Least Read Posts Widget
Author
whiletrue
“Most And Least Read Posts Widget” is a free plugin for WordPress. developed by Giuliano Polverari (WhileTrue.it) to generate lists of the most and least read posts. The following options are customizable: number of posts to show exclude posts whose title contains certain words show post hits after the title (style customizable via CSS class) exclude posts older than XX days The plugin starts counting hits once activated, storing them in the “custom_total_hits” custom field without the need of external accounts. The most popular web crawlers (e.g. Googlebot) are recognized and their hits discarded; also Admin hits are discarded. Archived post hits are shown in a column inside the backend post list. The plugin is compatible with multi-language WPML plugin, showing most/least read posts for current language. Optionally, the number of hits can be shown inside the post content, with: a custom phrase, e.g. “This post has already been read XX times!” a custom position (above the post, below the post, both) a custom CSS style If you want to show the post hits anywhere inside the template loop, you can the PHP function provided, e.g.: echo most_and_least_read_posts_get_hits(get_the_ID()); Shortcode Also, [most_read_posts] a shortcode is available. Use it like this: [most_read_posts type="most" posts_number="5" show_thumbs="false" date_from="2016-01-01" date_to="2016-04-30"] Shortcode attributes: type: “most” or “least” posts_number words_excluded title_max_chars excerpt_max_chars show_thumbs: “true” or “false” add_line_break_before_thumbs: “true” or “false” show_hits: “true” or “false” show_hits_text (default: “views”) days_ago date_from and date_to: if set, overwrite the “days_ago” attribute (format: YYYY-MM-DD) Reference For more informations: www.whiletrue.it Do you like this plugin? Give a chance to our other works: Good old Share Good old Twitter Feed Widget Tilted Tag Cloud Widget Reading Time
Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C