Burst Statistics Vulnerability – Authenticated Stored Cross-Site Scripting via burst_total_pageviews_count – CVE-2024-1894 |WordPress Plugin Vulnerability Report

Plugin Name: Burst Statistics – Privacy-Friendly Analytics for WordPress

Key Information:

  • Software Type: Plugin
  • Software Slug: burst-statistics
  • Software Status: Active
  • Software Author: rogierlankhorst
  • Software Downloads: 1,792,011
  • Active Installs: 100,000
  • Last Updated: March 14, 2024
  • Patched Versions: 1.5.7
  • Affected Versions: <=

Vulnerability Details:

  • Name: Burst Statistics <=
  • Title: Authenticated (Contributor+) Stored Cross-Site Scripting via burst_total_pageviews_count
  • Type: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
  • CVE: CVE-2024-1894
  • CVSS Score: 6.4
  • Publicly Published: March 12, 2024
  • Researcher: Webbernaut
  • Description: The Burst Statistics plugin for WordPress is susceptible to a Stored Cross-Site Scripting (XSS) vulnerability within the 'burst_total_pageviews_count' custom meta field, present in versions up to and including This issue arises due to the lack of sufficient input sanitization and output escaping, enabling authenticated individuals with at least contributor-level permissions to insert malicious scripts that are executed when the page is viewed by other users. It is important to note that this exploit is contingent on the victim having the 'Show Toolbar when viewing site' option activated in their profile.


The Burst Statistics plugin, a tool for integrating privacy-conscious analytics into WordPress sites, has encountered a significant security breach in versions up to This breach, identified as CVE-2024-1894, facilitates Authenticated Stored Cross-Site Scripting attacks via a specific custom meta field, jeopardizing both the security of the site and the privacy of its users. The developers have addressed this critical issue in the subsequent version 1.5.7, restoring the plugin's security integrity.

Detailed Overview:

Uncovered by cybersecurity researcher Webbernaut, CVE-2024-1894 highlights the paramount importance of robust input sanitization and output encoding within web development. This vulnerability's potential for exploitation by authenticated users underscores the necessity of comprehensive security measures in plugin development and the vigilant management of user roles and permissions on WordPress sites.

Advice for Users:

Immediate Action: Users are urged to promptly update their installation of the Burst Statistics plugin to version 1.5.7 to mitigate the vulnerability.

Check for Signs of Vulnerability: Site administrators should remain vigilant for any unauthorized script executions or content alterations, especially in sections utilizing the implicated widget, as these could be indicative of the vulnerability's exploitation.

Alternate Plugins: Although the patched version rectifies the identified vulnerability, users may contemplate alternative analytics plugins that prioritize both privacy and security, should they seek additional functionalities or assurances.

Stay Updated: Regular updates across all WordPress components, including plugins, themes, and the core system, are crucial for safeguarding against known vulnerabilities and ensuring optimal site functionality and security.


The swift resolution of CVE-2024-1894 within the Burst Statistics plugin serves as a vital reminder of the continuous necessity for vigilance and proactive security measures within the WordPress community. For WordPress site administrators, particularly those responsible for small businesses with limited technical resources, the dedication to routine software updates and adherence to security best practices is crucial for protecting digital assets against evolving cyber threats.



In today’s digital age, the security of your WordPress website cannot be taken lightly, especially with the increasing sophistication of cyber threats. A recent vulnerability uncovered in the popular WordPress plugin, Burst Statistics – Privacy-Friendly Analytics for WordPress, serves as a stark reminder of this ongoing challenge. Known for its privacy-focused analytics, this plugin has been a staple for many WordPress site owners who prioritize user privacy alongside insightful analytics.

Vulnerability Report Overview:

The vulnerability identified, CVE-2024-1894, stems from insufficient input sanitization and output escaping within the 'burst_total_pageviews_count' custom meta field, allowing authenticated users with contributor-level access to inject and execute arbitrary web scripts. This vulnerability only takes effect if the victim has enabled the 'Show Toolbar when viewing site' option, highlighting the nuanced conditions under which such threats can manifest.

Implications of the Vulnerability:

The implications of CVE-2024-1894 extend beyond mere website defacement; they compromise the integrity of affected sites and endanger user data privacy. Such vulnerabilities underscore the critical need for rigorous input validation and output encoding practices in plugin development.

Mitigating the Vulnerability:

To safeguard your website:

  • Update immediately: Ensure the Burst Statistics plugin is upgraded to version 1.5.7 or later.
  • Monitor for suspicious activity: Keep an eye out for unauthorized changes or script executions, particularly in areas utilizing the implicated widget.
  • Consider alternatives: While the patched version addresses this issue, exploring other analytics plugins might provide additional functionalities or security assurances.
  • Stay vigilant with updates: Regularly updating all WordPress components is crucial in maintaining a secure and functional website.

The Broader Context:

This incident isn't isolated; it's the latest in a series of vulnerabilities, with two others reported since December 6, 2023. Such patterns highlight the evolving landscape of cybersecurity threats and the imperative of staying abreast with the latest security updates and best practices.

Final Thoughts:

For small business owners, juggling the myriad responsibilities of running a business while ensuring the digital security of your WordPress site can be daunting. However, the recent vulnerability in Burst Statistics illustrates the non-negotiable nature of cybersecurity vigilance. Embracing a proactive stance on software updates and adhering to security best practices aren't just recommendations—they're essential measures to protect your digital presence in an increasingly interconnected world.

Staying Secure

Staying on top of WordPress security can feel overwhelming for small business owners without dedicated IT staff. At Your WP Guy, we exist to shoulder that burden for you. Our WordPress experts can fully audit, secure, maintain and support your site - so you can focus on growing your business with peace of mind.

Don't tackle security risks alone. Let us help you assess any impact from this vulnerability, update your plugins, and implement ongoing maintenance to avoid future threats. We treat your website like it's our own - because we know how critical it is for reaching your customers.

Get in touch for a free consultation today on making WordPress security stress-free. Call 678-995-5169 or book a call here. Our knowledgeable team is ready to help you safeguard your online presence.

Burst Statistics Vulnerability – Authenticated Stored Cross-Site Scripting via burst_total_pageviews_count – CVE-2024-1894 |WordPress Plugin Vulnerability Report FAQs

Leave a Comment