The pixelstats plugin for WordPress contains a reflected cross‑site scripting flaw that originates from the ‘post_id’ and ‘sortby’ query parameters. These values are not sanitized or escaped before being reflected back to the browser, giving an unauthenticated attacker the ability to inject arbitrary JavaScript into pages served by the site. Because the script is executed in the victim’s browser when the malicious link is clicked, the impact is limited to the scope of that browser session, enabling session hijacking, phishing, or other client‑side attacks. This weakness corresponds to CWE‑79.

The vulnerability resides in the pixelstats WordPress plugin, vendor pixelstats. All installations of the plugin with a version number of 0.8.2 or earlier are affected. The plugin must be installed on a WordPress site to be vulnerable, meaning any WordPress website that has pixelstats <=0.8.2 is at risk.

The CVSS base score of 6.1 classifies the issue as a moderate severity problem. The EPSS score of less than 1 percent indicates a low probability of exploitation at this time, and the vulnerability is not listed in the CISA KEV catalog. The attack vector is likely through a crafted URL that includes malicious ‘post_id’ or ‘sortby’ values, which is a reflected XSS scenario requiring the victim to click the link. While the impact is confined to the victim’s browser, attackers could use it in phishing campaigns or to compromise sessions on sites that are visited by users who click such links.