The aMiT Post Hits Counter plugin versions up to 2.8.23 contain a CSRF vulnerability that can be leveraged to trigger reflected XSS attacks. This combination allows attackers to potentially execute unauthorized actions and inject malicious scripts via crafted requests that exploit the lack of proper request validation and user interaction protections. The vulnerability is remotely exploitable without privileges but requires user interaction, and it impacts confidentiality, integrity, and availability to a limited extent.

Successful exploitation could allow attackers to perform actions on behalf of authenticated users and execute reflected XSS attacks, potentially leading to limited data disclosure, manipulation, or disruption of service. However, there are no reports of active exploitation in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider disabling or limiting the use of the affected plugin and apply standard CSRF and XSS mitigations where possible. Monitor vendor channels for updates regarding patches or official workarounds.