A stored cross‑site scripting flaw exists in the 3dady Real‑Time Web Stats plugin for WordPress 1.0. Unsanitized input fields named dady_input_text and dady2_input_text allow authenticated users to embed arbitrary JavaScript. When a victim visits the page where this input is rendered, the injected script runs in the context of the site, enabling attackers to steal session data, deface content, or redirect users.

The vulnerability affects the WordPress plugin named 3dady Real‑Time Web Stats, version 1.0. Any WordPress installation that has this plugin installed and has users with permission to edit the plugin options is susceptible.

The CVSS score of 5.1 indicates moderate severity; the EPSS score is not available, so exploitation probability is unknown. Attackers need an authenticated account that can modify the plugin options, typically an administrator or author level user. Once the payload is stored, it triggers on page view, so the impact is limited to browsers of users who view the page. The plug‑in is not listed in CISA’s KEV catalog, implying no widely known public exploitation at the time of this analysis.