CVE-2022-0434

The Page View Count WordPress plugin before version 2.4.15 is vulnerable to an unauthenticated SQL injection attack. The root cause is the failure to sanitize and escape the post_ids parameter when used in a SQL statement via a REST endpoint . This endpoint is accessible to both unauthenticated a...

CVE-2023-0095

The CVE-2023-0095 entry concerns the WordPress plugin Page View Count (before 2.6.1). The issue is that the plugin does not validate and escape certain block options when the Gutenberg block is embedded, enabling Stored XSS for users with the Contributor role or higher. Affects Page View Count

CVE-2021-24509

The CVE-2021-24509 vulnerability affects the WordPress Page View Count plugin before 2.4.9. The pvc_stats shortcode’s postid parameter is not escaped, allowing Stored XSS when mishandled inputs reach the frontend. Impact notes indicate that contributors can trigger XSS (with admin approval possib...