The Ninos FlashCounter WordPress plugin possesses a CSRF weakness that permits an attacker with authenticated access to inject arbitrary JavaScript that is stored by the plugin. This stored XSS can run in the browsers of all site visitors, enabling defacement, phishing, cookie theft or session hijacking. The flaw is classified as CWE‑352, indicating a lack of proper CSRF safeguards.

All WordPress sites that use the FlashCounter plugin version 1.1.8 or earlier are affected. The vulnerability spans every release of the plugin from its initial deployment through to the 1.1.8 cutoff.

The CVSS score of 7.1 denotes medium‑to‑high severity, while the EPSS score of less than 1 % suggests real‑world exploitation is currently unlikely and the issue is not listed in the CISA KEV catalog. The likely attack vector is a crafted URL that forces a logged‑in administrator or a trusted user to submit a state‑changing request to the plugin, thereby storing malicious JavaScript that executes later for all site visitors.