The Flexo Counter WordPress plugin is vulnerable to reflected cross‑site scripting due to improper input neutralisation during page generation. An attacker who can craft a URL containing malicious JavaScript can cause that code to execute in the browser of any visitor who follows the link, leading to cookie theft, session hijacking, defacement, or the loading of malicious resources.

The flaw affects the Flexo Counter plugin from flexostudio, from the earliest released version up to and including version 1.0001. Users running any of these versions on a WordPress site are vulnerable.

The CVSS score is 7.1, indicating a medium‑to‑high severity with a high impact on confidentiality, integrity and availability of user sessions. The EPSS score is below 1%, suggesting that exploitation attempts are unlikely at this time, and the vulnerability is not listed in CISA’s KEV catalog. The attack vector is web‑based; an attacker can exploit the flaw by embedding a malicious payload in a URL that is accessed by unsuspecting visitors. The vulnerability is reflected, meaning the attacker does not need any privileged access to the site to deliver the payload.