The Easy Plugin Stats plugin used in WordPress is affected by a stored cross‑site scripting flaw that stems from the 'eps' shortcode not properly sanitizing or escaping user‑supplied attributes. An attacker who has contributor or higher level permissions can embed malicious script code into a page that contains the shortcode. When any user views that page the script runs in the victim’s browser, allowing possible defacement, theft of session information, or other malicious actions.

WordPress installations running any version of the Easy Plugin Stats plugin from its initial release through version 2.0.1 are vulnerable. The product is distributed by ndiego and is commonly found on public sites that use the plugin to display statistics. The vulnerability affects all installations regardless of WordPress configuration, as it relies solely on the plugin’s shortcode rendering.

The CVSS score of 6.4 indicates a moderate severity, and the EPSS model indicates an exploitation probability of less than 1%. The flaw has not been listed in the CISA Known Exploited Vulnerabilities catalog. An attacker must first have authenticated contributor‑level access; a single malicious user can embed the exploit and wait for any visitor or administrator to load the infected page. While the EPSS suggests low sporadic attacks, the fact that the attack requires only local permissions means that compromised or malicious contributors could abuse the flaw to impact any site using the plugin.