The vulnerability is a stored cross‑site scripting flaw that allows attackers to inject malicious JavaScript into web pages generated by the Simple Blog Stats plugin. This flaw can lead to defacement, credential theft, or execution of arbitrary scripts in the context of site visitors who view the affected pages, compromising confidentiality and integrity of user sessions.

The issue affects the WordPress plugin Simple Blog Stats, versions from the earliest release up to and including 20250416, developed by Jeff Starr.

The CVSS v3.1 base score of 6.5 indicates medium‑high risk, while the EPSS score of < 1% suggests a very low probability of exploitation in the wild. The vulnerability is not listed in CISA’s KEV catalog. Based on the description, the attack vector is inferred to involve an attacker entering malicious input through the plugin’s interface, which is stored and later rendered without proper sanitization. If such input is viewed by an end user, the script executes in the victim’s browser.