The WP Online Users Stats plugin contains a missing nonce check inside the hk_dataset_results() function, which permits an unauthenticated attacker to trigger a forged request from a site administrator. This CSRF flaw enables the attacker to inject arbitrary scripts that are stored and later executed when other users load the admin page, resulting in stored XSS. The primary risk is the execution of malicious code in the context of the user’s browser, allowing for session hijacking, data theft, or site defacement. The weakness is identified as CWE‑352.

All installations of the WP Online Users Stats plugin provided by hk1993 with a version of 1.0.0 or earlier are affected. No further version granularity is supplied, so any instance that has not been upgraded past version 1.0.0 remains vulnerable.

The CVSS score of 6.1 indicates a moderate severity, while the EPSS score of less than 1% suggests that exploitation is expected to be rare. The vulnerability is not currently listed in the CISA KEV catalog. The likely attack path requires an attacker to trick an authenticated site administrator into clicking a crafted link or otherwise submitting a request that invokes hk_dataset_results() without proper nonce validation. Though the attack vector is constrained, the impact if successful is significant, warranting prompt remediation.