The Electric Studio Download Counter plugin for WordPress contains a stored cross‑site scripting flaw. Vulnerable input fields in the plugin settings are not properly sanitized or escaped, allowing an attacker to embed arbitrary JavaScript. An attacker who can log in with administrator privileges or higher can inject scripts that will be served to any user who views a page that loads the injected content, enabling session hijacking, credential theft or defacement of the site. That is the primary impact for all affected installations.

All installations of the Electric Studio Download Counter plugin up to version 2.4, regardless of the WordPress version, are affected. The vulnerability is present in every release in the 2.4 series as documented in the product’s codebase at referenced line numbers.

The flaw is rated a CVSS score of 4.4, indicating low to moderate severity, and the EPSS score is below 1 %, signalling very low exploitation probability at the time of this analysis. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. The attack vector requires the attacker to have authenticated administrator‑level access, after which they can edit the settings page to inject malicious payloads. The resulting cross‑site scripting can affect all visitors who load pages that include the stored script.