Improper neutralization of user input during web page generation allows a reflected Cross‑Site Scripting attack within the WP‑Click‑Tracker plugin. This flaw (CWE‑79) permits attackers to inject arbitrary client‑side scripts when a victim visits a crafted URL or interacts with a vulnerable input field. Successful exploitation can lead to cookie theft, session hijacking, defacement of the site, or the delivery of malware to visitors, thereby compromising confidentiality, integrity, and availability for the affected website.

The vulnerability impacts WordPress installations that use the WP‑Click‑Tracker plugin from any pre‑version through 0.7.3, published by mithra62. Any WordPress site running a version of the plugin in this range is susceptible; newer releases are not affected.

The CVSS score of 7.1 classifies this as a high‑severity issue, but the EPSS score of < 1 % indicates that real‑world exploitation is currently unlikely. The flaw is reflected and therefore requires an attacker to send a specifically crafted request to the target site, which is a moderate technical barrier. It is not listed in the CISA KEV catalog, so no large‑scale outbreak is known. Organizations should assume that an attacker could target the plugin by embedding a malicious link in email or other social media and rely on victim interaction.