StatCounter – Real Time Visitor Stats, Session Replay & Heatmaps

StatCounter – Real Time Visitor Stats, Session Replay & Heatmaps has 4 disclosed vulnerabilities in the WordSec catalog, reported between 2022 and 2026; all 4 are fixed as of September 2026. Their average CVSS score is 6.0, and the most serious one scores 6.4 out of 10. 2026 was the busiest year with 3 disclosures.

The most common weakness is Cross-Site Scripting, behind 4 of the records (100%).

Every one of the 4 issues recorded for StatCounter – Real Time Visitor Stats, Session Replay & Heatmaps has a vendor fix available, so running the current release closes all known holes.

4 independent researchers contributed these findings, one record each. StatCounter – Real Time Visitor Stats, Session Replay & Heatmaps is installed on roughly 70,000 WordPress sites, so each unpatched flaw has a wide blast radius. The current release is tested up to WordPress 7.0.4.

Strategic Overview

Avg CVSSMedium
6.0/ 10
Patch Coverage100%
Open

0

Fixed

4

Get automatic notifications for all StatCounter – Real Time Visitor Stats, Session Replay & Heatmaps vulnerabilities before they are exploited.

Highest severity on recordCVSS 6.4CVE-2026-57629

StatCounter – Free Real Time Visitor Stats <= 2.1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting

Read the full analysis

Vulnerability Records

4 records
Plugin Profile
Latestv2.2.0

StatCounter – Real Time Visitor Stats, Session Replay & Heatmaps

StatCounter

Author

StatCounter

4.1(49)
82/100
Last Updated
2026-08-19 (25d ago)
Active Installs
70,000+
Downloads
2,090,269
Requires WP
2.0.2+
Requires PHP
0+
Tested up to
WP 7.0.4
Created
2008-02-11 (19y ago)

The Official StatCounter WordPress Plugin adds StatCounter to your site in a couple of clicks – no code editing required. StatCounter has provided reliable, real-time visitor analytics to millions of websites since 1999, and now includes session replay and heatmaps. Session Replay Watch recordings of real visits to your site – a video-like playback of each visitor’s clicks, scrolls and page navigation: See exactly where visitors get stuck, confused or frustrated Understand why visitors abandon carts, forms and signups Watch how visitors from a specific campaign, country or referrer actually use your site Improve support: replay a customer’s session to see what went wrong Heatmaps See at a glance where your visitors click – and what they ignore: Click heatmaps highlight the links, buttons and images getting the most attention Interactive elements like dropdowns and mobile menus are tracked too Spot “dead clicks” on elements that look clickable but aren’t Compare engagement across desktop and mobile Real-Time Visitor Stats All the classic StatCounter reports, updated in real time: Popular pages, entry pages and exit pages Incoming traffic: referring sites, keywords and campaigns Visitor paths, visit length and returning visits Country, state and city stats with a recent visitor map Browser, OS, screen resolution and ISP stats Magnify individual visitors for a detailed session report Email reports, multiple site management and user access management Invisible counter option See all features Pricing Core visitor stats are free forever on the Basic plan. Session replay and heatmaps are premium features, and every new account starts with a 30-day free trial – no credit card required. View pricing

Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C