CVE-2026-1047

The salavat counter Plugin for WordPress contains a stored cross-site scripting (XSS) vulnerability in all versions up to and including 0.9.5. The issue originates from insufficient input sanitization and output escaping on the 'image_url' parameter, allowing an authenticated attacker to inject arbitrary web scripts [1].

Exploitation requires authentication with administrator-level access or above. The attacker can inject malicious script content via the image_url field, which is then stored and executed whenever a user accesses the affected page. No further privileges or unusual network position is needed beyond the administrator role [1].

An attacker leveraging this vulnerability could execute arbitrary JavaScript in the browser of any user's browser session, potentially leading to session hijacking, defacement, or information theft. The impact is elevated by the fact that the stored payload persists and affects all visitors, including site administrators themselves [1].

The plugin has been closed by its developer as of February 17, 2026, and is no longer available for download due to this security issue [1]. No patched version exists; users are advised to remove the plugin immediately and review their sites for indicators of compromise.