CVE-2026-1047

Description

The salavat counter Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'image_url' parameter in all versions up to, and including, 0.9.5 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

PUBLISHED Reserved 2026-01-16 | Published 2026-02-19 | Updated 2026-02-19 | Assigner Wordfence

Problem types

CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Product status

Timeline

Credits

Bhumividh Treloges finder

References

www.wordfence.com/...-c6e5-4413-b7dc-894965daa5ac?source=cve

downloads.wordpress.org/plugin/salavat-counter.zip

wordpress.org/plugins/salavat-counter/

plugins.trac.wordpress.org/...ags/0.9.5/wp-table-options.php

plugins.trac.wordpress.org/...ter/trunk/wp-table-options.php

cve.org (CVE-2026-1047)

nvd.nist.gov (CVE-2026-1047)

Download JSON