StatCounter – Free Real Time Visitor Stats Security & Risk Analysis

wordpress.org/plugins/official-statcounter-plugin-for-wordpress

StatCounter.com powered real-time detailed stats about the visitors to your blog.

70K active installs v2.1.1 PHP + WP 2.0.2+ Updated Dec 2, 2025
counterhitstatisticsstatsweb
98
A · Safe
CVEs total2
Unpatched0
Last CVEFeb 18, 2026
Safety Verdict

Is StatCounter – Free Real Time Visitor Stats Safe to Use in 2026?

Generally Safe

Score 98/100

StatCounter – Free Real Time Visitor Stats has a strong security track record. Known vulnerabilities have been patched promptly.

2 known CVEsLast CVE: Feb 18, 2026Updated 4mo ago
Risk Assessment

The official-statcounter-plugin-for-wordpress v2.1.1 exhibits a generally strong security posture based on the provided static analysis. The plugin demonstrates excellent adherence to secure coding practices, with no identified dangerous functions, 100% of SQL queries using prepared statements, and a remarkable 97% of output properly escaped. The absence of file operations and external HTTP requests also reduces potential attack vectors. Furthermore, the limited attack surface, with zero identified entry points and the presence of nonce checks, indicates a proactive approach to security.

Key Concerns

  • Medium severity vulnerabilities found
  • Two medium CVEs in vulnerability history
  • Capability checks are missing
Vulnerabilities
2

StatCounter – Free Real Time Visitor Stats Security Vulnerabilities

CVEs by Year

1 CVE in 2022
2022
1 CVE in 2026
2026
Patched Has unpatched

Severity Breakdown

Medium
2

2 total CVEs

CVE-2025-13048medium · 6.4Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Official StatCounter Plugin <= 2.1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Nickname

Feb 18, 2026 Patched in 2.1.1 (1d)
CVE-2021-24920medium · 4.8Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

StatCounter <= 2.0.6 - Admin+ Stored Cross-Site Scripting

Jan 26, 2022 Patched in 2.0.7 (727d)
Code Analysis
Analyzed Mar 16, 2026

StatCounter – Free Real Time Visitor Stats Code Analysis

Dangerous Functions
0
Raw SQL Queries
0
0 prepared
Unescaped Output
2
72 escaped
Nonce Checks
2
Capability Checks
0
File Operations
0
External Requests
0
Bundled Libraries
0

Output Escaping

97% escaped74 total outputs
Data Flows
All sanitized

Data Flow Analysis

4 flows
statcounter_options_page (StatCounter-Wordpress-Plugin.php:71)
Source (user input) Sink (dangerous op) Sanitizer Transform Unsanitized Sanitized
Attack Surface

StatCounter – Free Real Time Visitor Stats Attack Surface

Entry Points0
Unprotected0
WordPress Hooks 13
actionadmin_menuStatCounter-Wordpress-Plugin.php:27
actionadmin_menuStatCounter-Wordpress-Plugin.php:28
actionwp_headStatCounter-Wordpress-Plugin.php:29
actionadmin_headStatCounter-Wordpress-Plugin.php:38
actionwp_headStatCounter-Wordpress-Plugin.php:226
actionwp_footerStatCounter-Wordpress-Plugin.php:228
actioninittrunk\StatCounter-Wordpress-Plugin.php:22
actionadmin_menutrunk\StatCounter-Wordpress-Plugin.php:23
actionadmin_menutrunk\StatCounter-Wordpress-Plugin.php:24
actionwp_enqueue_scriptstrunk\StatCounter-Wordpress-Plugin.php:25
actionwp_headtrunk\StatCounter-Wordpress-Plugin.php:26
filterscript_loader_tagtrunk\StatCounter-Wordpress-Plugin.php:28
actionadmin_headtrunk\StatCounter-Wordpress-Plugin.php:49
Maintenance & Trust

StatCounter – Free Real Time Visitor Stats Maintenance & Trust

Maintenance Signals

WordPress version tested6.8.5
Last updatedDec 2, 2025
PHP min version
Downloads2.0M

Community Trust

Rating80/100
Number of ratings47
Active installs70K
Developer Profile

StatCounter – Free Real Time Visitor Stats Developer Profile

StatCounter

1 plugin · 70K total installs

78
trust score
Avg Security Score
98/100
Avg Patch Time
364 days
View full developer profile
Detection Fingerprints

How We Detect StatCounter – Free Real Time Visitor Stats

Patterns used to identify this plugin on WordPress sites during automated security audits and web crawling.

Asset Fingerprints

HTML / DOM Fingerprints

CSS Classes
options
Data Attributes
id="statcounter_frame"id="statcounter_options"name="statcounter_options"id="sc_project"name="sc_project"id="sc_security"+5 more
FAQ

Frequently Asked Questions about StatCounter – Free Real Time Visitor Stats