The Simple Download Counter WordPress plugin contains a stored XSS weakness that arises when the 'text' and 'cat' attributes of the sdc_menu shortcode are not sanitized or escaped before being written to the page. An attacker who can add or edit content and has Contributor level access can supply malicious JavaScript that is injected directly into the HTML of any post, page, or widget containing the shortcode, causing the script to run in the browsers of all visitors that view the page. This does not grant direct server access but enables client‑side attacks such as phishing or cookie theft for any user who loads the affected content.

WordPress installations running the Simple Download Counter plugin version 2.3 or earlier are affected. The vulnerability applies to all releases up to and including 2.3 and requires the attacker to have at least Contributor level privileges to edit or create content that uses the vulnerable shortcode.

The CVSS score of 6.4 indicates moderate severity. Exploitation requires authenticated access, specifically Contributors or higher, which limits the potential attacker pool. The flaw is not listed in CISA’s KEV catalog and no EPSS score is available, but any user who views an affected page could be exposed to arbitrary script execution.