Improper neutralization of user input during web page generation enables stored cross‑site scripting within the Elegant Visitor Counter plugin. A malicious script injected via the plugin’s input fields can be rendered and executed by any user who views the affected page, potentially allowing attackers to steal session cookies, deface content, or redirect visitors.

WordPress sites that have installed the regolithsjk Elegant Visitor Counter plugin version 3.1 or earlier are affected. The vulnerability exists across all releases up to and including 3.1, so any site using that plugin without an upgrade is vulnerable.

The CVSS score of 5.9 indicates a moderate risk. The EPSS score of less than 1% suggests that exploitation is unlikely at this time, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector involves an attacker injecting malicious input through the plugin’s configuration interface, which is then stored and subsequently rendered to site visitors. Successful exploitation would affect the confidentiality, integrity, and availability of the site for all users who view the affected pages.