Visitor Stats Widget
Visitor Stats Widget has one disclosed vulnerability in the WordSec catalog, all reported in 2025; it remains unpatched as of September 2026. Their average CVSS score is 6.1, and the most serious one scores 6.1 out of 10.
The most common weakness is Cross-Site Scripting, behind 1 of the records (100%).
The one issue recorded for Visitor Stats Widget has no published fix yet, which makes virtual patching the only reliable mitigation. The oldest unresolved one dates back to 2025.
All of these findings were reported by Nguyen Xuan Chien. Visitor Stats Widget is installed on roughly 50 WordPress sites, so each unpatched flaw has a wide blast radius. The current release is tested up to WordPress 3.2.0.
CVE-2025-68874Visitor Stats Widget <= 1.5.0 - Reflected Cross-Site Scripting
Read the full analysisVulnerability Records
Visitor Stats Widget
Author
Shahjada
Real-time stats for your wordpress site. A list of pages people are currently reading. Beside each page the number of people on that page. Popular pages are near the top of the list. A list of recent readers and the pages they were or are on is also available. We know you can’t monitor the widget 24/7, so we do that for you. Easily check how many people were simultaneously on your site, down to the hour. Finally, no stats page is complete without knowing where people come from. Our maps pinpoint the location for every one of your readers — live, right down to their city! Arbitrary section N/A A brief Markdown Example
Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C