The Visit Counter plugin for WordPress contains an improper input neutralization flaw that leads to stored cross‑site scripting. This can allow an attacker to inject malicious script into the site’s rendered pages, potentially compromising user credentials, session cookies, or allowing malware delivery. The weakness is a classic Stored XSS, categorized as CWE‑79.

Affected systems include any WordPress site running BestiaDurmiente’s Visit Counter plugin version 1.0 or earlier. The plugin is reachable via the WordPress admin interface and renders visitor counts on publicly accessible pages, making stored payloads visible to all site visitors.

The CVSS score of 7.1 indicates a high severity of this flaw. EPSS is below 1%, suggesting a low likelihood of automated exploitation at present, and the issue is not listed in CISA’s KEV. However, because the plugin resides in publicly accessible pages and the payload is stored until page load, an attacker could craft a URL or form that injects script, which would then be served to any user who views the affected page. Based on the description, it is inferred that the attack vector is local to the plugin’s input handling but the impact extends to all site visitors.