The PluginsPoint Kento WordPress Stats plugin (version 1.1 and earlier) contains a stored cross-site scripting vulnerability due to improper input neutralization during web page generation. This flaw allows attackers to inject malicious scripts that persist and execute when other users access the affected pages. The vulnerability has a CVSS 3.1 base score of 7.1, reflecting network accessibility, low complexity, no privileges needed, user interaction required, and impacts on confidentiality, integrity, and availability. No official patch or remediation guidance is currently provided, and no known exploits have been reported.

Successful exploitation of this stored XSS vulnerability could allow attackers to execute arbitrary scripts in the browsers of users who visit the affected pages, potentially leading to data theft, session hijacking, or other malicious actions impacting confidentiality, integrity, and availability. The vulnerability is exploitable remotely without authentication but requires user interaction.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users should consider disabling or removing the affected plugin version to mitigate risk. Monitor official PluginsPoint communications for updates regarding patches or mitigations.