The WPS Visitor Counter WordPress plugin up to version 1.4.8 fails to escape the $_SERVER['REQUEST_URI'] variable before it is included in an HTML attribute. This flaw allows an attacker to inject arbitrary JavaScript that is reflected back to the victim when the URL is visited. The root cause is improper input validation, a common cause for XSS vulnerabilities (CWE‑79).

The affected product is the WordPress plugin WPS Visitor Counter, any installation of any version up to and including 1.4.8. Websites that have installed these versions are potentially vulnerable, independent of the host or domain. No other vendors or products were listed in the CNA data.

The CVSS score of 5.8 classifies the vulnerability as moderate severity. The EPSS score of less than 1 percent indicates a very low probability that the flaw is being actively exploited in the wild. The vulnerability is not included in the CISA Known Exploited Vulnerabilities catalog. Attackers would need to create a malicious URL that includes unescaped characters in the request URI, publish or otherwise distribute that link, and convince a victim to click it. The exploitation is limited to the victim’s browser session and does not modify server state or affect other users.