The Simple Download Counter plugin for WordPress contains an Improper Neutralization of Input During Web Page Generation flaw that allows attackers to inject malicious JavaScript that is stored in the site, leading to Stored XSS. This weakness can be used to steal user session cookies, deface the site, or run arbitrary scripts in the context of users who view affected pages. The flaw is identified as CWE‑79.

The vulnerability affects Jeff Starr’s Simple Download Counter plugin for WordPress versions from the earliest releases through 2.2. Site administrators using any of these versions are at risk unless the plugin has been removed or updated to 2.3 or later.

The CVSS score of 6.5 indicates a moderate severity vulnerability, while the EPSS score of less than 1% shows a low likelihood of exploitation in the wild; the issue is not currently listed in the CISA KEV catalog. Exploitation requires an attacker to create or modify download counter data containing the payload, which is then rendered on the site and executed in unsuspecting visitors’ browsers. Administrators should treat this as an actionable risk and apply the official patch promptly.