The StatCounter plugin for WordPress contains a stored cross‑site scripting flaw that allows attackers with Contributor or higher privileges to embed arbitrary JavaScript using the user Nickname field. The injected code is stored and rendered each time a page that displays the nickname is viewed, enabling malicious scripts to run in the context of any site visitor. This vulnerability corresponds to CWE‑79, where insufficient input validation and output escaping give an attacker code‑execution capabilities on the client side.

The affected product is the StatCounter – Free Real Time Visitor Stats WordPress plugin, versions up to and including 2.1.0.

With a CVSS score of 6.4 the issue is considered medium severity. The EPSS probability is below 1 %, indicating that the likelihood of exploitation is currently very low, and the vulnerability is not listed in the CISA KEV catalog. However, exploitation requires an authenticated account with Contributor or higher permissions, so the risk remains for sites that have not upgraded the plugin and have such user roles in place.