LiveActive security incident?Get immediate response
CVE Record

CVE-2016-10981: The kento-post-view-counter plugin through 2.8 for WordPress has stored XSS via kento_pvc_numbers_lang, ken...

The kento-post-view-counter plugin through 2.8 for WordPress has stored XSS via kento_pvc_numbers_lang, kento_pvc_today_text, or kento_pvc_total_text.

UnknownCVSS not scoredNot KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysismoderate

Security readout for executives and security teams

Plain-English summary

CVE-2016-10981 is a stored cross-site scripting issue in the kento-post-view-counter WordPress plugin through version 2.8. A malicious value in specific plugin text fields could be saved and later rendered to visitors or administrators. The sources do not provide CVSS, required privileges, or confirmed active exploitation.

Executive priority

Prioritize public WordPress sites using this plugin, especially sites with many visitors or privileged administrators. The business risk is website trust and session integrity, but urgency is moderated by missing evidence on exploitation and prerequisites.

Technical view

The CVE describes stored XSS via kento_pvc_numbers_lang, kento_pvc_today_text, or kento_pvc_total_text in kento-post-view-counter through 2.8. Exposure depends on whether the plugin is installed and whether those fields can contain unsafe script or markup. Source evidence does not identify authentication requirements, exploit maturity, or a named fixed release.

Likely exposure

Likely limited to WordPress sites running kento-post-view-counter version 2.8 or earlier. Sites not using this plugin are not exposed based on the provided sources.

Exploitation context

Stored XSS can affect users who view pages where saved plugin output is rendered. No KEV listing or cited source confirms active exploitation. The bundle does not define attacker access level, affected roles, or whether exploitation requires administrative access.

Researcher notes

Evidence is sparse: the record names vulnerable fields and affected plugin versions but lacks CVSS, CWE, privilege requirements, fixed version, and exploit telemetry. Treat the issue as confirmed stored XSS, then validate exposure in the actual WordPress configuration.

Mitigation direction

  • Inventory WordPress sites for kento-post-view-counter and record installed versions.
  • Update the plugin if vendor guidance identifies a fixed version.
  • Disable or remove the plugin where version 2.8 or earlier remains in use.
  • Review the named plugin text fields for unexpected markup or script content.
  • Limit WordPress administrative access to trusted users while remediation is pending.

Validation and detection

  • Confirm whether kento-post-view-counter is installed on each WordPress instance.
  • Verify the installed version is later than 2.8 or document compensating action.
  • Inspect kento_pvc_numbers_lang, kento_pvc_today_text, and kento_pvc_total_text values.
  • Review relevant WordPress pages for unexpected plugin-rendered script or markup.
  • Check vendor plugin information for current maintenance and remediation guidance.
Prepared
Confidence
medium
Sources
4

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2016-10981 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Unknown
CVSS
Not scored
Known Exploited
No
Published
Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

0CVSS vectors
0Timeline events
0ADP providers
3Source links

CVSS and timeline data

No CVSS vectors or timeline events were available in the normalized CVE source material.

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
n/an/an/aListed
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.