A reflected cross-site scripting vulnerability in the Shahjada Visitor Stats Widget plugin allows unauthenticated attackers to execute arbitrary scripts in a user's browser.

This vulnerability is a reflected cross-site scripting (XSS) flaw (CWE-79) triggered by improper neutralization of user-supplied input. It allows an unauthenticated attacker to inject malicious scripts into the web page generated by the plugin, which then execute in the context of the victim's browser session.

Successful exploitation of this vulnerability can lead to session hijacking, unauthorized actions performed on behalf of an authenticated user, and the theft of sensitive session data or cookies. With a CVSS score of 7.1, this represents a high-severity risk to web application integrity and user privacy, potentially leading to significant reputational damage if attackers successfully redirect users or compromise administrative accounts.

Immediate Action: Since a specific patch version is currently unknown, administrators should immediately deactivate and remove the Visitor Stats Widget plugin until a secure update is released by the vendor.

Proactive Monitoring: Monitor web server access logs for anomalous GET requests containing script tags or suspicious URL parameters that deviate from standard plugin behavior.

Compensating Controls: Deploy a Web Application Firewall (WAF) with robust XSS protection rules to detect and block malicious payloads targeting the plugin's input parameters.

Public Exploit Available: No.

Given the high CVSS score and the nature of XSS attacks, the security risk is significant. Organizations using this plugin should prioritize its removal or restriction until the developer provides a verified security update, as reflected XSS can easily be weaponized to target privileged site administrators.