This host is running WordPress with Count per Day plugin and is prone to multiple vulnerabilities.

Successful exploitation will allow attacker to execute arbitrary HTML or web script in a user's browser session in context of an affected site, cause denial of service, and discloses the software installation path results in a loss of confidentiality. Impact Level: Application

Update to version 3.2.6 or later, For updates refer to http://wordpress.org/extend/plugins/count-per-day

- Malicious input passed via 'daytoshow' parameter to /wp-content /wp-admin/index.php script is not properly sanitised before being returned to the user. - Malicious input passed via POST parameters to wordpress/wp-content/plugins /count-per-day/notes.php script is not properly sanitised before being returned to the user. - Malformed GET request to ajax.php, counter-core.php, counter-options.php, counter.php, massbots.php, and userperspan.php scripts.

WordPress Count per Day plugin <= 3.2.5

• http://seclists.org/fulldisclosure/2013/Mar/43
• http://seclists.org/fulldisclosure/2013/Mar/48
• http://www.osvdb.com/90832
• http://www.osvdb.com/90833
• http://www.osvdb.com/90893

---

Updated on 2015-03-25