Based on the description, it is inferred that improper neutralization of user input during web page generation in the WordPress Date Counter plugin allows attackers to store malicious scripts in the database. When processed, the stored payload is rendered on site pages, enabling client‑side code execution, session hijacking, defacement, or phishing. This is a classic Stored XSS weakness (CWE‑79) that can impact all users who view affected content.

WordPress sites that use Konstantin Pankratov’s Date Counter plugin, version 2.0.3 and earlier.

The vulnerability carries a CVSS score of 6.5 and an EPSS score of less than 1 %. It is not listed in the CISA KEV catalog. Attackers would need to submit a malicious payload through the plugin’s input interface, which is typically web‑accessible. While exploitation probability is low, the risk remains for any site that still hosts the vulnerable plugin.