The kStats Reloaded WordPress plugin up to version 0.7.4 contains a reflected XSS flaw caused by inadequate sanitization of user‑supplied data during page rendering. This flaw allows an attacker to inject arbitrary JavaScript that executes in the browsers of users who visit the affected URLs, enabling session hijacking, credential theft, or site defacement. The weakness is a classic input validation failure (CWE‑79).

Any WordPress installation running the Mark kStats Reloaded plugin version 0.7.4 or earlier is affected. No other plugin versions or components are listed as vulnerable.

The CVSS score of 7.1 reflects a medium‑to‑high impact, while the EPSS score of <1% indicates a low but non‑zero probability of exploitation. It is not catalogued in the CISA KEV. The likely attack path is attacker‑driven social engineering, where a malicious link is delivered to a user; once the victim loads the link, the reflected XSS runs client‑side code, compromising confidentiality or integrity of the session.