The 4stats WordPress plugin is prone to Cross‑Site Request Forgery because it fails to validate nonces on the stats/stats.php page. This flaw allows an unauthenticated attacker to trick an administrator into submitting a forged request, altering the plugin’s settings and remotely injecting malicious JavaScript. The injected script is stored in the plugin’s configuration and executed on subsequent page loads, giving the attacker persistent cross‑site scripting that can compromise the confidentiality and integrity of the site, deface content, or conduct phishing.

The vulnerability affects the 4stats plugin for WordPress, versions up to and including 2.0.9. The plugin is hosted in the WordPress repository and can be installed on any WordPress site regardless of hosting environment.

The CVSS score of 6.1 indicates a medium severity exploit due to the requirement of an administrator being tricked into performing an action; the EPSS score of less than 1% indicates that exploitation is currently unlikely but not impossible. The vulnerability is not listed in the CISA KEV catalog, suggesting no known widespread exploitation yet, but the combination of CSRF and stored XSS makes it a attractive target for attackers. An attacker would need to obtain an authenticated session or persuade an administrator to visit a malicious link; once the payload is stored, any visitor to the affected WordPress site would load the malicious script.