CVE-2025-13048 is a stored cross-site scripting vulnerability in the StatCounter – Free Real Time Visitor Stats WordPress plugin, affecting all versions up to 2.1.0. The flaw allows authenticated users with Contributor-level permissions or higher to inject arbitrary web scripts through the user's Nickname field due to improper input neutralization during web page generation. These scripts execute when any user accesses the compromised page, potentially leading to information disclosure or session hijacking. The vulnerability has a CVSS 3.1 score of 6.4, reflecting a medium impact with network attack vector, low attack complexity, and no user interaction required.

Successful exploitation allows authenticated users with Contributor or higher privileges to inject and execute arbitrary scripts in the context of other users viewing the affected pages. This can lead to limited confidentiality and integrity impacts such as theft of session tokens or modification of displayed content. There is no direct impact on availability. The vulnerability does not affect unauthenticated users and requires some level of access to the WordPress site.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict Contributor-level access to trusted users only and consider monitoring for suspicious nickname inputs. Applying strict input validation and output escaping on the nickname field can mitigate the risk. Avoid visiting pages with untrusted user-generated content where possible.