The vulnerability is a Cross‑Site Request Forgery (CSRF) flaw that allows an attacker to inject a persistent script into the WordPress database. When the stored script is subsequently rendered to site visitors, it runs in their browsers. This can enable arbitrary client‑side code execution, potentially affecting the confidentiality or integrity of user interaction on the site.

The flaw affects the EricH WordPress plugin The Visitor Counter. All releases up to and including version 1.4.3 are vulnerable.

The CVSS score of 7.1 reflects a high severity, while the EPSS score of less than 1% indicates a low probability of active exploitation. The vulnerability is not listed in the CISA KEV catalog. The likely attack vector is web‑based; an attacker could send a forged request that exploits the CSRF weakness to store malicious script. Based on the description, it is inferred that any visitor to the site after the payload is stored would execute the injected script in their browser context.