StatCounter – Real Time Visitor Stats, Session Replay & Heatmaps
StatCounter – Real Time Visitor Stats, Session Replay & Heatmaps has 4 disclosed vulnerabilities in the WordSec catalog, reported between 2022 and 2026; all 4 are fixed as of September 2026. Their average CVSS score is 6.0, and the most serious one scores 6.4 out of 10. 2026 was the busiest year with 3 disclosures.
The most common weakness is Cross-Site Scripting, behind 4 of the records (100%).
Every one of the 4 issues recorded for StatCounter – Real Time Visitor Stats, Session Replay & Heatmaps has a vendor fix available, so running the current release closes all known holes.
4 independent researchers contributed these findings, one record each. StatCounter – Real Time Visitor Stats, Session Replay & Heatmaps is installed on roughly 70,000 WordPress sites, so each unpatched flaw has a wide blast radius. The current release is tested up to WordPress 7.0.4.
CVE-2026-57629StatCounter – Free Real Time Visitor Stats <= 2.1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
Read the full analysisVulnerability Records
StatCounter – Real Time Visitor Stats, Session Replay & Heatmaps
Author
StatCounter
The Official StatCounter WordPress Plugin adds StatCounter to your site in a couple of clicks – no code editing required. StatCounter has provided reliable, real-time visitor analytics to millions of websites since 1999, and now includes session replay and heatmaps. Session Replay Watch recordings of real visits to your site – a video-like playback of each visitor’s clicks, scrolls and page navigation: See exactly where visitors get stuck, confused or frustrated Understand why visitors abandon carts, forms and signups Watch how visitors from a specific campaign, country or referrer actually use your site Improve support: replay a customer’s session to see what went wrong Heatmaps See at a glance where your visitors click – and what they ignore: Click heatmaps highlight the links, buttons and images getting the most attention Interactive elements like dropdowns and mobile menus are tracked too Spot “dead clicks” on elements that look clickable but aren’t Compare engagement across desktop and mobile Real-Time Visitor Stats All the classic StatCounter reports, updated in real time: Popular pages, entry pages and exit pages Incoming traffic: referring sites, keywords and campaigns Visitor paths, visit length and returning visits Country, state and city stats with a recent visitor map Browser, OS, screen resolution and ISP stats Magnify individual visitors for a detailed session report Email reports, multiple site management and user access management Invisible counter option See all features Pricing Core visitor stats are free forever on the Basic plan. Session replay and heatmaps are premium features, and every new account starts with a 30-day free trial – no credit card required. View pricing
Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C