CVE-2025-50052

Vulnerability Overview Flexo Counter plugin for WordPress versions up to 1.0001 suffer from a reflected Cross-Site Scripting (XSS) vulnerability due to improper neutralization of input during web page generation [1]. This allows an attacker to inject arbitrary HTML and JavaScript into web pages.

Exploitation The vulnerability is reflected XSS, meaning the malicious payload is embedded in a crafted URL or form submission. Successful exploitation requires a privileged user (e.g., administrator) to click a malicious link or visit a crafted page. No authentication is needed from the attacker, but user interaction is required.

Impact An attacker can execute arbitrary scripts in the context of the victim's browser, leading to actions such as redirecting users to malicious sites, injecting advertisements, or stealing sensitive data. This could compromise the site's integrity and user trust.

Mitigation The vendor has not released an official patch. However, Patchstack provides a mitigation rule to block attacks until a patch is available [1]. Users are advised to update the plugin as soon as a fix is released or apply the mitigation rule.