Free tool
Is my WordPress plugin safe?
Type a plugin or theme and the version you run, and we’ll show every known vulnerability that affects it, from the 390,080 records in our vulnerability database. The version is listed under Plugins in your WordPress dashboard.
Plugin · page-views-count
Page View Count
6 known vulnerabilities on record. Add your version above to see which ones affect you.
Dec 9, 2025Page View Count: Missing AuthorizationCVE-2025-63034 · affects up to 2.9.0 · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in Steve Truman Page View Count page-views-count allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Page View Count: from n/a through <= 2.9.0.
Apr 30, 2025Page View Count: Unauthorized modification of data that can lead to a denial of serviceCVE-2025-2816 · affects 2.8.0 to 2.8.4 · reported by WordfenceHigh 8.1
The Page View Count plugin for WordPress is vulnerable to unauthorized modification of data that can lead to a denial of service due to a missing capability check on the yellow_message_dontshow() function in versions 2.8.0 to 2.8.4. This makes it possible for authenticated attackers, with Subscriber-level access and above, to update option values to one on the WordPress site. This can be leveraged to update an option that would create an error on the site and deny service to legitimate users or be used to set some values to true such as registration.
Feb 6, 2023Page View Count: Does not validate and escape some of its block options before outputting them back in a page/post where the block is embedCVE-2023-0095 · fixed in 2.6.1 · reported by WPScanMedium 5.4
The Page View Count WordPress plugin before 2.6.1 does not validate and escape some of its block options before outputting them back in a page/post where the block is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
Nov 3, 2022a3rev Software Page View Count plugin <= 2.5.5 on: Cross-Site Request Forgery (CSRF)CVE-2022-40131 · affects up to 2.5.5 · reported by PatchstackMedium 5.4
Cross-Site Request Forgery (CSRF) vulnerability in a3rev Software Page View Count plugin <= 2.5.5 on WordPress allows an attacker to reset the plugin settings.
Mar 7, 2022Page View Count: Does not sanitise and escape the post_ids parameter before using it in a SQL statement via a REST endpointCVE-2022-0434 · fixed in 2.4.15 · reported by WPScanCritical 9.8
The Page View Count WordPress plugin before 2.4.15 does not sanitise and escape the post_ids parameter before using it in a SQL statement via a REST endpoint, available to both unauthenticated and authenticated users. As a result, unauthenticated attackers could perform SQL injection attacks
Aug 9, 2021Page View Count: Does not escape the postid parameter of pvc_stats shortcodeCVE-2021-24509 · fixed in 2.4.9 · reported by WPScanMedium 5.4
The Page View Count WordPress plugin before 2.4.9 does not escape the postid parameter of pvc_stats shortcode, allowing users with a role as low as Contributor to perform Stored XSS attacks. A post made by a contributor would still have to be approved by an admin to have the XSS triggered in the frontend, however, higher privilege users, such as editor could exploit this without the need of approval, and even when the blog disallows the unfiltered_html capability.
Versions are matched against the affected ranges published with each record. A plugin can ship a fix under its own numbering, so if something looks off, check the linked record. Want the whole site checked at once? Run the free website check.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.